pytroll / pytroll/pyresample

Remove Configobj as Dependency Due To Security Vulnerability and No Longer Maintaned

Open
#589 5 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
385
Forks
102
Avg merge
4d 2h
Merged PRs (30d)
9

Description

Configobj has an identified security vulnerability and seems to be no longer maintained. Recommend removing configobj as a dependency so pyresample is not affected or limited in use because of this. It appears it is only used in one place so believe this should not be too difficult and I will look at doing it and creating a pull request. The _create_area method in area_config.py line 352 is the only place I see this is used.

Configobj has an open CVE, https://github.com/advisories/GHSA-c33w-24p9-8m24, All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function. There is an open issue in the github repo along with a pull request for over a year with no movement. This package appears to be unmaintained and abandoned.

https://github.com/DiffSK/configobj/issues/232

Thanks,
Aaron

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the _create_area method in area_config.py around line 352 and inspect how configobj is used there and where the dependency is declared. Check the surrounding area configuration behavior and existing tests, if present; done means pyresample no longer depends on configobj while area creation continues to work without the reported vulnerability.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Refactor
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.