gianistsol / python-p2p Goto Github PK

Description:

I have identified a security vulnerability in the python-p2p v 1.7.1 project by our cryptographic api misuse detection tool.The issue pertains to the use of a default RSA key length of 1024 bits, which is considered insecure due to advances in computing power and cryptographic weaknesses associated with shorter key lengths.

References:

CWE-326: Inadequate Encryption Strength
NIST SP 800-131A r2

Location：

https://github.com/GianisTsol/python-p2p/blob/master/pythonp2p/crypto_funcs.py#L10

Recommendations:

I recommend the following actions to mitigate the vulnerability:
Upgrade the RSA key length to a more secure option, such as 2048 bits.

Discovering routers... Traceback (most recent call last): File "C:\Users\benin\OneDrive\Documenti\GitHub\python-p2p\pythonp2p\__main__.py", line 4, in <module> new = Node("", PORT, FILE_PORT) # start the node File "C:\Users\benin\OneDrive\Documenti\GitHub\python-p2p\pythonp2p\node.py", line 152, in __init__ portforwardlib.forwardPort(port, port, None, None, False, "TCP", 0, "", True) File "C:\Users\benin\OneDrive\Documenti\GitHub\python-p2p\pythonp2p\portforwardlib.py", line 240, in forwardPort status, message = open_port( File "C:\Users\benin\OneDrive\Documenti\GitHub\python-p2p\pythonp2p\portforwardlib.py", line 177, in open_port conn = http.client.HTTPConnection(parsedurl.hostname, parsedurl.port) File "C:\Program Files\WindowsApps\PythonSoftwareFoundation.Python.3.9_3.9.3568.0_x64__qbz5n2kfra8p0\lib\urllib\parse.py", line 178, in port raise ValueError(message) from None ValueError: Port could not be cast to integer value as '57970None'

on python 3.10.1 crypto lib cannot be installed deprecated lib warning was showed
depricated log.txt

Here's my server:

>>> from pythonp2p import Node
>>> class Mynode(Node):
...   def on_message(message, sender, private):
...     print('MESSAGE:', message)
...
>>>
>>> node = Mynode()
Discovering routers...
Discovering routers...
[debug] Initialisation of the Node on port: 65432
>>> node.start()
Pinger Started
>>> File Server Started

Here's my client:

>>> from pythonp2p import Node
>>> node = Node()
Discovering routers...
Discovering routers...
[debug] Initialisation of the Node on port: 65432
>>> node.connect_to('97.117.28.178')
[debug] connecting to 97.117.28.178 port 65432
[debug] connect_to: Could not connect with node. ([WinError 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond)
>>>

the ip address I'm using is the ip address I get from doing a "what's my ip" search on the server machine.

https://github.com/GianisTsol/python-p2p/blob/master/p2pnetwork/node.py#L285 is one such spot.
Wrapping something in str() is not a way to sanitize input or prevent code execution.