Veracode Scan Vulnerability: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) about gunicorn HOT 6 CLOSED

why do you think it's a vulnerability? this looks like a simple "re-execute itself" logic...

from gunicorn.

I don't think it is a vulnerability necessarily, but our Veracode scanner is rating it as "Very High" (the highest possible). Hopefully I can mark it off as "reported to library maintainer" or "false-positive".

from gunicorn.

Thanks for the report. Does it provides more i fo about it? Any more logs? I don't see any issue with this code myself.

from gunicorn.

I'm gonna close this... sorry for wasting your time. I don't see much other information and it just links to https://cwe.mitre.org/data/definitions/78.html. Some of the other flaws it found in other libs were kinda silly or vague too except for Flask signing their session cookies with sha1.

from gunicorn.

We could drop the p from suffixes: sys.executable is guaranteed to be an absolute path (or empty string, or None), we are never actually asking to investigate $PATH. The remaining static analysers should be happy once type annotations are inline.

from gunicorn.

Thank you @pajod !

from gunicorn.