Build #10

Plan branch:

Build: #10 failed Manual run by Akeem Wells

Build result summary

Details

Completed
Queue duration
1 second
Duration
1 minute
Labels
None
Revisions
Casa6
c84be1413a0d775fc6fe17d180f968a1475a1fa6
OPEN-CASA-PKG
e5285e68467f01199807a1f1a978aec8a4781be7
Total tests
360
Failing since
#7 (Manual run by Akeem Wells – )

Tests

Responsible

This build has been failing since #7
No one has taken responsibility

Tests

New test failures 228
Status Test View job Duration
Collapse Failed py B403 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Consider possible security implications associated with pickle module.
Test ID: B403
Severity: LOW
Confidence: HIGH
CWE: 502 (https://cwe.mitre.org/data/definitions/502.html)
Location: /wheeldirectory/casa6/casatasks/setup.py:82
Code: 82
Consider possible security implications associated with pickle module.
(1 more lines...)
Collapse Failed py B310 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
Test ID: B310
Severity: MEDIUM
Confidence: HIGH
CWE: 22 (https://cwe.mitre.org/data/definitions/22.html)
Location: /wheeldirectory/casa6/casatasks/setup.py:421
Code: 421
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
(1 more lines...)
Collapse Failed py B404 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/setup.py:75
Code: 75
Consider possible security implications associated with the subprocess module.
(1 more lines...)
Collapse Failed py B603 - subprocess_without_shell_equals_true
Bandit CASA6 CasaTasks < 1 sec 
LOW: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/setup.py:121
Code: 121
subprocess call - check for execution of untrusted input.
(1 more lines...)
Collapse Failed py B102 - exec_used
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Use of exec detected.
Test ID: B102
Severity: MEDIUM
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/callibrary.py:303
Code: 303
Use of exec detected.
(1 more lines...)
Collapse Failed py B318 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Using xml.dom.minidom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
Test ID: B318
Severity: MEDIUM
Confidence: HIGH
CWE: 20 (https://cwe.mitre.org/data/definitions/20.html)
Location: /wheeldirectory/casa6/casatasks/src/private/casaxmlutil.py:182
Code: 182
Using xml.dom.minidom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
(1 more lines...)
Collapse Failed py B102 - exec_used
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Use of exec detected.
Test ID: B102
Severity: MEDIUM
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/casaxmlutil.py:158
Code: 158
Use of exec detected.
(1 more lines...)
Collapse Failed py B408 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Using minidom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace minidom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
Test ID: B408
Severity: LOW
Confidence: HIGH
CWE: 20 (https://cwe.mitre.org/data/definitions/20.html)
Location: /wheeldirectory/casa6/casatasks/src/private/casaxmlutil.py:4
Code: 4
Using minidom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace minidom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
(1 more lines...)
Collapse Failed py B110 - try_except_pass
Bandit CASA6 CasaTasks < 1 sec 
LOW: Try, Except, Pass detected.
Test ID: B110
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/cleanhelper.py:295
Code: 295
Try, Except, Pass detected.
(1 more lines...)
Collapse Failed py B404 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/cleanhelper.py:11
Code: 11
Consider possible security implications associated with the subprocess module.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/cleanhelper.py:479
Code: 479
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/concatephem.py:123
Code: 123
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/convertephem.py:141
Code: 141
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B310 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
Test ID: B310
Severity: MEDIUM
Confidence: HIGH
CWE: 22 (https://cwe.mitre.org/data/definitions/22.html)
Location: /wheeldirectory/casa6/casatasks/src/private/correct_ant_posns_evla.py:97
Code: 97
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
(1 more lines...)
Collapse Failed py B408 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Using minidom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace minidom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
Test ID: B408
Severity: LOW
Confidence: HIGH
CWE: 20 (https://cwe.mitre.org/data/definitions/20.html)
Location: /wheeldirectory/casa6/casatasks/src/private/flaghelper.py:1962
Code: 1962
Using minidom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace minidom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/flaghelper.py:1038
Code: 1038
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B318 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Using xml.dom.minidom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
Test ID: B318
Severity: MEDIUM
Confidence: HIGH
CWE: 20 (https://cwe.mitre.org/data/definitions/20.html)
Location: /wheeldirectory/casa6/casatasks/src/private/flaghelper.py:1986
Code: 1986
Using xml.dom.minidom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
(1 more lines...)
Collapse Failed py B307 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Use of possibly insecure function - consider using safer ast.literal_eval.
Test ID: B307
Severity: MEDIUM
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/flaghelper.py:982
Code: 982
Use of possibly insecure function - consider using safer ast.literal_eval.
(1 more lines...)
Collapse Failed py B110 - try_except_pass
Bandit CASA6 CasaTasks < 1 sec 
LOW: Try, Except, Pass detected.
Test ID: B110
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/ialib.py:44
Code: 44
Try, Except, Pass detected.
(1 more lines...)
Collapse Failed py B404 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/imagerhelpers/_gclean.py:47
Code: 47
Consider possible security implications associated with the subprocess module.
(1 more lines...)
Collapse Failed py B101 - assert_used
Bandit CASA6 CasaTasks < 1 sec 
LOW: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/imagerhelpers/_gclean.py:2164
Code: 2164
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
(1 more lines...)
Collapse Failed py B404 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/imagerhelpers/imager_parallel_cube.py:333
Code: 333
Consider possible security implications associated with the subprocess module.
(1 more lines...)
Collapse Failed py B307 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Use of possibly insecure function - consider using safer ast.literal_eval.
Test ID: B307
Severity: MEDIUM
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/imagerhelpers/input_parameters.py:922
Code: 922
Use of possibly insecure function - consider using safer ast.literal_eval.
(1 more lines...)
Collapse Failed py B310 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
Test ID: B310
Severity: MEDIUM
Confidence: HIGH
CWE: 22 (https://cwe.mitre.org/data/definitions/22.html)
Location: /wheeldirectory/casa6/casatasks/src/private/jplhorizons_query.py:185
Code: 185
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
(1 more lines...)
Collapse Failed py B310 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
Test ID: B310
Severity: MEDIUM
Confidence: HIGH
CWE: 22 (https://cwe.mitre.org/data/definitions/22.html)
Location: /wheeldirectory/casa6/casatasks/src/private/jyperk.py:507
Code: 507
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
(1 more lines...)
Collapse Failed py B101 - assert_used
Bandit CASA6 CasaTasks < 1 sec 
LOW: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/jyperk.py:49
Code: 49
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
(1 more lines...)
Collapse Failed py B404 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/mslisthelper.py:7
Code: 7
Consider possible security implications associated with the subprocess module.
(1 more lines...)
Collapse Failed py B110 - try_except_pass
Bandit CASA6 CasaTasks < 1 sec 
LOW: Try, Except, Pass detected.
Test ID: B110
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/mstools.py:59
Code: 59
Try, Except, Pass detected.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/parallel/parallel_data_helper.py:597
Code: 597
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B607 - start_process_with_partial_path
Bandit CASA6 CasaTasks < 1 sec 
LOW: Starting a process with a partial executable path
Test ID: B607
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/parallel/parallel_data_helper.py:1611
Code: 1611
Starting a process with a partial executable path
(1 more lines...)
Collapse Failed py B603 - subprocess_without_shell_equals_true
Bandit CASA6 CasaTasks < 1 sec 
LOW: subprocess call - check for execution of untrusted input.
Test ID: B603
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/parallel/parallel_data_helper.py:1611
Code: 1611
subprocess call - check for execution of untrusted input.
(1 more lines...)
Collapse Failed py B404 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/parallel/parallel_data_helper.py:8
Code: 8
Consider possible security implications associated with the subprocess module.
(1 more lines...)
Collapse Failed py B110 - try_except_pass
Bandit CASA6 CasaTasks < 1 sec 
LOW: Try, Except, Pass detected.
Test ID: B110
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/parallel/parallel_data_helper.py:1618
Code: 1618
Try, Except, Pass detected.
(1 more lines...)
Collapse Failed py B307 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Use of possibly insecure function - consider using safer ast.literal_eval.
Test ID: B307
Severity: MEDIUM
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/parallel/parallel_task_helper.py:657
Code: 657
Use of possibly insecure function - consider using safer ast.literal_eval.
(1 more lines...)
Collapse Failed py B102 - exec_used
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Use of exec detected.
Test ID: B102
Severity: MEDIUM
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/parallel/parallel_task_helper.py:248
Code: 248
Use of exec detected.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/partitionhelper.py:125
Code: 125
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B108 - hardcoded_tmp_directory
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Probable insecure usage of temp file/directory.
Test ID: B108
Severity: MEDIUM
Confidence: MEDIUM
CWE: 377 (https://cwe.mitre.org/data/definitions/377.html)
Location: /wheeldirectory/casa6/casatasks/src/private/partitionhelper.py:36
Code: 36
Probable insecure usage of temp file/directory.
(1 more lines...)
Collapse Failed py B404 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Consider possible security implications associated with the subprocess module.
Test ID: B404
Severity: LOW
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/partitionhelper.py:13
Code: 13
Consider possible security implications associated with the subprocess module.
(1 more lines...)
Collapse Failed py B602 - subprocess_popen_with_shell_equals_true
Bandit CASA6 CasaTasks < 1 sec 
HIGH: subprocess call with shell=True identified, security issue.
Test ID: B602
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/partitionhelper.py:699
Code: 699
subprocess call with shell=True identified, security issue.
(1 more lines...)
Collapse Failed py B311 - blacklist
Bandit CASA6 CasaTasks < 1 sec 
LOW: Standard pseudo-random generators are not suitable for security/cryptographic purposes.
Test ID: B311
Severity: LOW
Confidence: HIGH
CWE: 330 (https://cwe.mitre.org/data/definitions/330.html)
Location: /wheeldirectory/casa6/casatasks/src/private/sdint_helper.py:19
Code: 19
Standard pseudo-random generators are not suitable for security/cryptographic purposes.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/sdint_helper.py:38
Code: 38
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B108 - hardcoded_tmp_directory
Bandit CASA6 CasaTasks < 1 sec 
MEDIUM: Probable insecure usage of temp file/directory.
Test ID: B108
Severity: MEDIUM
Confidence: MEDIUM
CWE: 377 (https://cwe.mitre.org/data/definitions/377.html)
Location: /wheeldirectory/casa6/casatasks/src/private/setjy_helper.py:515
Code: 515
Probable insecure usage of temp file/directory.
(1 more lines...)
Collapse Failed py B112 - try_except_continue
Bandit CASA6 CasaTasks < 1 sec 
LOW: Try, Except, Continue detected.
Test ID: B112
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/setjy_helper.py:126
Code: 126
Try, Except, Continue detected.
(1 more lines...)
Collapse Failed py B101 - assert_used
Bandit CASA6 CasaTasks < 1 sec 
LOW: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/simutil.py:3311
Code: 3311
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/task_apparentsens.py:29
Code: 29
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/task_concat.py:274
Code: 274
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/task_conjugatevis.py:62
Code: 62
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Collapse Failed py B101 - assert_used
Bandit CASA6 CasaTasks < 1 sec 
LOW: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/task_cvel.py:193
Code: 193
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
(1 more lines...)
Collapse Failed py B101 - assert_used
Bandit CASA6 CasaTasks < 1 sec 
LOW: Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
Test ID: B101
Severity: LOW
Confidence: HIGH
CWE: 703 (https://cwe.mitre.org/data/definitions/703.html)
Location: /wheeldirectory/casa6/casatasks/src/private/task_cvel2.py:45
Code: 45
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
(1 more lines...)
Collapse Failed py B605 - start_process_with_a_shell
Bandit CASA6 CasaTasks < 1 sec 
HIGH: Starting a process with a shell, possible injection detected, security issue.
Test ID: B605
Severity: HIGH
Confidence: HIGH
CWE: 78 (https://cwe.mitre.org/data/definitions/78.html)
Location: /wheeldirectory/casa6/casatasks/src/private/task_exportasdm.py:80
Code: 80
Starting a process with a shell, possible injection detected, security issue.
(1 more lines...)
Existing test failures 2
Status Test Failing since View job Duration 
Found 3 vulnerability/ies
- CVE-2022-1941: ### Summary  A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries.  Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)  Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.  ### Severity & Impact As scored by google   **Medium 5.7** - [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)   Asscored byt NIST   **High 7.5** - [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)  A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.  ### Proof of Concept  For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.  ### Mitigation / Patching  Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) - protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)
- CVE-2025-4565: ### Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of **recursive groups**, **recursive messages** or **a series of [`SGROUP`](https://protobuf.dev/programming-guides/encoding/#groups) tags** can be corrupted by exceeding the Python recursion limit.  Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team [ecosystem@trailofbits.com](mailto:ecosystem@trailofbits.com)  Affected versions: This issue only affects the [pure-Python implementation](https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends) of protobuf-python backend. This is the implementation when `PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python` environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default.  This is a Python variant of a [previous issue affecting protobuf-java](https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8).  ### Severity This is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker.  ### Proof of Concept For reproduction details, please refer to the unit tests [decoder_test.py](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98) and [message_test](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478)  ### Remediation and Mitigation A mitigation is available now. Please update to the latest available versions of the following packages: * protobuf-python(4.25.8, 5.29.5, 6.31.1)
- CVE-2026-0994: A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.  Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.
 
Found 3 vulnerability/ies
- CVE-2022-1941: ### Summary  A message parsing and memory management vulnerability in ProtocolBuffer’s C++ and Python implementations can trigger an out of memory (OOM) failure when processing a specially crafted message, which could lead to a denial of service (DoS) on services using the libraries.  Reporter: [ClusterFuzz](https://google.github.io/clusterfuzz/)  Affected versions: All versions of C++ Protobufs (including Python) prior to the versions listed below.  ### Severity & Impact As scored by google   **Medium 5.7** - [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)   Asscored byt NIST   **High 7.5** - [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)  A small (~500 KB) malicious payload can be constructed which causes the running service to allocate more than 3GB of RAM.  ### Proof of Concept  For reproduction details, please refer to the unit test that identifies the specific inputs that exercise this parsing weakness.  ### Mitigation / Patching  Please update to the latest available versions of the following packages: - protobuf-cpp (3.18.3, 3.19.5, 3.20.2, 3.21.6) - protobuf-python (3.18.3, 3.19.5, 3.20.2, 4.21.6)
- CVE-2025-4565: ### Summary Any project that uses Protobuf pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of **recursive groups**, **recursive messages** or **a series of [`SGROUP`](https://protobuf.dev/programming-guides/encoding/#groups) tags** can be corrupted by exceeding the Python recursion limit.  Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team [ecosystem@trailofbits.com](mailto:ecosystem@trailofbits.com)  Affected versions: This issue only affects the [pure-Python implementation](https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends) of protobuf-python backend. This is the implementation when `PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION=python` environment variable is set or the default when protobuf is used from Bazel or pure-Python PyPi wheels. CPython PyPi wheels do not use pure-Python by default.  This is a Python variant of a [previous issue affecting protobuf-java](https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8).  ### Severity This is a potential Denial of Service. Parsing nested protobuf data creates unbounded recursions that can be abused by an attacker.  ### Proof of Concept For reproduction details, please refer to the unit tests [decoder_test.py](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98) and [message_test](https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478)  ### Remediation and Mitigation A mitigation is available now. Please update to the latest available versions of the following packages: * protobuf-python(4.25.8, 5.29.5, 6.31.1)
- CVE-2026-0994: A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.  Due to missing recursion depth accounting inside the internal Any-handling logic, an attacker can supply deeply nested Any structures that bypass the intended recursion limit, eventually exhausting Python’s recursion stack and causing a RecursionError.

Shared artifacts

Artifact File size
vulnerabilities.xml 8 KB
requirements.txt 1 KB