Query PR
github/codeql#10656
Language
Python
CVE(s) ID list
N/A
CWE
No response
Report
This is continuation of my other issue, #561.
The issue was scored a low and received a lower bounty. The low score was a surprise as the query was immediately moved to stable after merge. Now that the results are available on LGTM, I can see there are multiple alerts in a file called pam.py. All of these seem to be due to a common vulnerable dependency which was copied across multiple projects. I can see for most alerts, the projects don't seem to actually even invoke a call to the enclosing function. I take it, this was the reason for the low score.
I am now proposing new changes to the query. I now add a taint-tracking configuration to check if the vulnerable pam_authenticate is actually invoked. This should lead to a very significant reduction in the number of alerts.
With this, I would request that my earlier bug report be updated to the new severity. Please don't create a new Hackerone report for this change.
Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
Blog post link
No response
Query PR
github/codeql#10656
Language
Python
CVE(s) ID list
N/A
CWE
No response
Report
This is continuation of my other issue, #561.
The issue was scored a low and received a lower bounty. The low score was a surprise as the query was immediately moved to stable after merge. Now that the results are available on LGTM, I can see there are multiple alerts in a file called
pam.py. All of these seem to be due to a common vulnerable dependency which was copied across multiple projects. I can see for most alerts, the projects don't seem to actually even invoke a call to the enclosing function. I take it, this was the reason for the low score.I am now proposing new changes to the query. I now add a taint-tracking configuration to check if the vulnerable
pam_authenticateis actually invoked. This should lead to a very significant reduction in the number of alerts.With this, I would request that my earlier bug report be updated to the new severity. Please don't create a new Hackerone report for this change.
Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
Blog post link
No response