🐛 [BUG] - `safety` reports CVE in `pip` with Python 3.11 about slo-generator HOT 7 CLOSED

Thanks @mrtergl for investigating. I will dedicate some time to this issue and your PR tomorrow afternoon.

from slo-generator.

This only happens for Python 3.11. Other versions install pip v23.3, as requested by setup.cfg.

dev =
    pip >=23.3  # avoid known vulnerabilities in pip <23.3 (reported by `safety check`)

Not sure why Python 3.11 is ignoring these requirements.

from slo-generator.

Actually, python tries to get 23.3 or above while installing dependencies in Python 3.11 but it says Requirement already satisfied in that path:

Requirement already satisfied: pip>=23.3 in /opt/hostedtoolcache/Python/3.11.7/x64/lib/python3.11/site-packages (from slo-generator==2.5.2) (23.3.2)

Then safety check command runs:

Safety v2.3.4 is scanning for Vulnerabilities...
Scanning dependencies in your environment:

-> /opt/hostedtoolcache/Python/3.11.7/x64/lib/python3.11/site-packages

it is scanning exactly the same path v23.3 supposed to be but however it scans v23.2.1 and vuln come up.

Vulnerability found in pip version 23.2.1
Vulnerability ID: 62044
Affected spec: <23.3
ADVISORY: Pip 23.3 includes a fix for CVE-2023-5752: When installing

Note: I've tried with v2.3.5 for safety as well (in a point while installing dependencies, it downgrades safety) but no change occurred.

I've tried to pass lint test for Python 3.11 in related PR : #413
@lvaylet

from slo-generator.

safety completes successfully within make docker_test when the base image is set to Python 3.11 instead of 3.9 currently (with FROM python:3.11-slim, resulting in Python 3.11.7 being installed, same version as in the CI pipeline). So Python 3.11 might not be the issue here.

from slo-generator.

The Dockerfile runs pip install -U setuptools before installing the remaining packages:

FROM python:3.11-slim
[...]
RUN pip install -U setuptools
RUN pip install ."[api, datadog, dynatrace, prometheus, elasticsearch, opensearch, splunk, pubsub, cloud_monitoring, cloud_service_monitoring, cloud_storage, bigquery, cloudevent, dev]"

Would it make sense to include pip install -U setuptools at the beginning of make install too?

from slo-generator.

I tried forcing an update of setuptools and pip in #424 before installing the other packages but safety still reports a CVE with pip 23.2.1 while 23.3.2 is actually installed (as confirmed by running pip --version just before safety check).

More details: https://github.com/google/slo-generator/actions/runs/7640294745/job/20815118754#step:5:92

from slo-generator.

The issue disappeared on the latest PRs. For example, every check in #422 completes just fine.

from slo-generator.