Comments (3)
It looks like there is no active maintenance on this module at the moment, as no valid commits have been made for about a year, and obvious issues (black issue) on the last commits have not been addressed.
It looks like a fork would be useful at this point. Seeing that this lib also contains a whole lot of application code its not really a lib anymore, and would benefit from being a little bit smaller and broken into smaller parts.
Judging by the response noted on the CVE page, a fix is not forthcoming.
NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case.
Seeing that the author feels no need to mitigate against this very easily exploited issue should send shockwaves to any user of this lib.
from python-libnmap.
Just a note here, I don't exactly know where this dispute quote comes from but these are not my words. When the bug hunter found the issue, I've accepted it as a security issue but could not provide a fix short/mid-term. Since he was waiting for publication of the issue I said the following:
Bug hunter: "Ok, I'm waiting for the new release."
Yours truly: "ok, but you can already apply for cve and disclose if you want. its not really a problem. I think there are enough means to ensure proper inputs are passed to the lib if being used otherwise."
Which translates to: since this lib (or helper if you prefer to call it like that) would most likely be interfaced, filtering should be straight forward for the developers using it.
Hope it clarifies.
from python-libnmap.
It looks like a fork would be useful at this point. Seeing that this lib also contains a whole lot of application code its not really a lib anymore, and would benefit from being a little bit smaller and broken into smaller parts.
@underdarknl interesting proposal! Now the world is waiting for your PR and/or your refactoring of the lib/helper. Keep me posted on your progresses.
regards,
Ronald
from python-libnmap.
Related Issues (20)
- Issue parsing NSE output from xml HOT 3
- parsing hostnames should return the type of the hostname detected i.e user or PTR HOT 2
- Project still alive? Wrong XML structure: cannot parse data HOT 7
- CC-BY Licence is not recommended for code - should move to an equivalent OSS licence HOT 2
- parser detect if xml is incomplete
- Install fails on windows 10 due to characer encoding issue in README.rst HOT 1
- Script results may contain "None" dict keys HOT 2
- handle the <hosthint> xml tag
- Running with sudo without passwordless setup hangs
- Release of 0.7.3 HOT 4
- Does python-libnmap library require "nmap" binary to be installed? HOT 2
- Syntax for printing the vulnerblities
- Python 2 compatibility
- Future maintenance of this project HOT 1
- XML Injection DoS attack HOT 5
- Multiprocess nmap problem. HOT 2
- Basic indentation/syntax errors in 3.6? HOT 4
- Require overriding of nmap arguments
- process.py returns 'Object has no attribute Format' HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from python-libnmap.