[Snyk] Fix for 7 vulnerabilities #14552

hedera-eng-infrastructure · 2024-08-02T05:59:06Z

Snyk has created this PR to fix 7 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

hedera-node/test-clients/scripts/diff-testing/requirements.txt

⚠️

Warning

``` googleapis-common-protos 1.62.0 requires protobuf, which is not installed. google-cloud-storage 2.14.0 requires requests, which is not installed. google-api-core 2.16.2 requires requests, which is not installed. google-api-core 2.16.2 requires protobuf, which is not installed.

</details>





---

> [!IMPORTANT]
>
> - Check the changes in this PR to ensure they won't cause issues with your project.
> - Max score is 1000. Note that the real score may have changed since the PR was raised.
> - This PR was automatically created by Snyk using the credentials of a real user.
> - Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

---

**Note:** _You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs._

For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiI4YzFiMzkwNC0wNDM4LTRiOGEtOTcxYy1hMWFjOGIyMmQ0NDEiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6IjhjMWIzOTA0LTA0MzgtNGI4YS05NzFjLWExYWM4YjIyZDQ0MSJ9fQ==" width="0" height="0"/>
🧐 [View latest project report](https://app.snyk.io/org/hedera-services/project/1a728c5e-a796-4363-9a52-e329fc359640?utm_source&#x3D;github-enterprise&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr)
📜 [Customise PR templates](https://docs.snyk.io/scan-using-snyk/pull-requests/snyk-fix-pull-or-merge-requests/customize-pr-templates)
🛠 [Adjust project settings](https://app.snyk.io/org/hedera-services/project/1a728c5e-a796-4363-9a52-e329fc359640?utm_source&#x3D;github-enterprise&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings)
📚 [Read about Snyk's upgrade logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities)

---

**Learn how to fix vulnerabilities with free interactive lessons:**

🦉 [NULL Pointer Dereference](https://learn.snyk.io/lesson/null-dereference/?loc&#x3D;fix-pr)
🦉 [Uncontrolled Resource Consumption (&#x27;Resource Exhaustion&#x27;)](https://learn.snyk.io/lesson/redos/?loc&#x3D;fix-pr)

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"certifi","from":"2024.2.2","to":"2024.7.4"},{"name":"cryptography","from":"42.0.2","to":"42.0.8"},{"name":"idna","from":"3.6","to":"3.7"},{"name":"requests","from":"2.31.0","to":"2.32.2"},{"name":"zipp","from":"3.15.0","to":"3.19.1"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CERTIFI-7430173","priority_score":519,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Insufficient Verification of Data Authenticity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CERTIFI-7430173","priority_score":519,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Insufficient Verification of Data Authenticity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CERTIFI-7430173","priority_score":519,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Insufficient Verification of Data Authenticity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CERTIFI-7430173","priority_score":519,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Insufficient Verification of Data Authenticity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CERTIFI-7430173","priority_score":519,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Insufficient Verification of Data Authenticity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CERTIFI-7430173","priority_score":519,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Insufficient Verification of Data Authenticity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CERTIFI-7430173","priority_score":519,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.1","score":305},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Insufficient Verification of Data Authenticity"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CRYPTOGRAPHY-6261585","priority_score":509,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.9","score":295},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"NULL Pointer Dereference"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CRYPTOGRAPHY-6592767","priority_score":399,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"3.7","score":185},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Uncontrolled Resource Consumption ('Resource Exhaustion')"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-CRYPTOGRAPHY-6913422","priority_score":399,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"3.7","score":185},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Uncontrolled Resource Consumption"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-IDNA-6597975","priority_score":524,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Resource Exhaustion"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-IDNA-6597975","priority_score":524,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Resource Exhaustion"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-IDNA-6597975","priority_score":524,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Resource Exhaustion"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-IDNA-6597975","priority_score":524,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Resource Exhaustion"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-IDNA-6597975","priority_score":524,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Resource Exhaustion"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-IDNA-6597975","priority_score":524,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Resource Exhaustion"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-IDNA-6597975","priority_score":524,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Resource Exhaustion"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-REQUESTS-6928867","priority_score":494,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.6","score":280},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Always-Incorrect Control Flow Implementation"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-REQUESTS-6928867","priority_score":494,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.6","score":280},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Always-Incorrect Control Flow Implementation"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-REQUESTS-6928867","priority_score":494,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.6","score":280},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Always-Incorrect Control Flow Implementation"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-REQUESTS-6928867","priority_score":494,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.6","score":280},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Always-Incorrect Control Flow Implementation"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-REQUESTS-6928867","priority_score":494,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.6","score":280},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Always-Incorrect Control Flow Implementation"},{"exploit_maturity":"No Known Exploit","id":"SNYK-PYTHON-REQUESTS-6928867","priority_score":494,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.6","score":280},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Always-Incorrect Control Flow Implementation"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-ZIPP-7430899","priority_score":666,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.9","score":345},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Infinite loop"},{"exploit_maturity":"Proof of Concept","id":"SNYK-PYTHON-ZIPP-7430899","priority_score":666,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.9","score":345},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Infinite loop"}],"prId":"8c1b3904-0438-4b8a-971c-a1ac8b22d441","prPublicId":"8c1b3904-0438-4b8a-971c-a1ac8b22d441","packageManager":"pip","priorityScoreList":[519,509,399,399,524,494,666],"projectPublicId":"1a728c5e-a796-4363-9a52-e329fc359640","projectUrl":"https://app.snyk.io/org/hedera-services/project/1a728c5e-a796-4363-9a52-e329fc359640?utm_source=github-enterprise&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["pr-warning-shown","priorityScore"],"type":"auto","upgrade":[],"vulns":["SNYK-PYTHON-CERTIFI-7430173","SNYK-PYTHON-CRYPTOGRAPHY-6261585","SNYK-PYTHON-CRYPTOGRAPHY-6592767","SNYK-PYTHON-CRYPTOGRAPHY-6913422","SNYK-PYTHON-IDNA-6597975","SNYK-PYTHON-REQUESTS-6928867","SNYK-PYTHON-ZIPP-7430899"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

…o reduce vulnerabilities The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-7430173 - https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6261585 - https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6592767 - https://snyk.io/vuln/SNYK-PYTHON-CRYPTOGRAPHY-6913422 - https://snyk.io/vuln/SNYK-PYTHON-IDNA-6597975 - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-6928867 - https://snyk.io/vuln/SNYK-PYTHON-ZIPP-7430899

github-actions · 2024-08-02T06:07:04Z

Node: HAPI Test (Restart) Results

7 files 7 suites 8m 16s ⏱️
6 tests 6 ✅ 0 💤 0 ❌
7 runs 7 ✅ 0 💤 0 ❌

Results for commit 45b0b19.

github-actions · 2024-08-02T06:07:04Z

Node: HAPI Test (Token) Results

22 files 22 suites 6m 33s ⏱️
281 tests 281 ✅ 0 💤 0 ❌
364 runs 364 ✅ 0 💤 0 ❌

Results for commit 45b0b19.

github-actions · 2024-08-02T06:07:05Z

Node: HAPI Test (Node Death Reconnect) Results

3 tests 3 ✅ 4m 58s ⏱️
3 suites 0 💤
3 files 0 ❌

Results for commit 45b0b19.

github-actions · 2024-08-02T06:07:07Z

Node: HAPI Test (Crypto) Results

24 files 24 suites 11m 12s ⏱️
347 tests 347 ✅ 0 💤 0 ❌
372 runs 372 ✅ 0 💤 0 ❌

Results for commit 45b0b19.

github-actions · 2024-08-02T06:07:08Z

Node: HAPI Test (Smart Contract) Results

91 files 91 suites 23m 5s ⏱️
658 tests 658 ✅ 0 💤 0 ❌
835 runs 835 ✅ 0 💤 0 ❌

Results for commit 45b0b19.

github-actions · 2024-08-02T06:07:10Z

Node: HAPI Test (Time Consuming) Results

19 tests 19 ✅ 23m 20s ⏱️
4 suites 0 💤
4 files 0 ❌

Results for commit 45b0b19.

github-actions · 2024-08-02T06:07:31Z

Node: HAPI Test (Misc) Results

61 files 61 suites 17m 0s ⏱️
318 tests 318 ✅ 0 💤 0 ❌
408 runs 408 ✅ 0 💤 0 ❌

Results for commit 45b0b19.

github-actions · 2024-08-02T06:08:03Z

Node: Unit Test Results

1 545 files 1 545 suites 3h 29m 52s ⏱️
117 440 tests 117 381 ✅ 59 💤 0 ❌
125 654 runs 125 595 ✅ 59 💤 0 ❌

Results for commit 45b0b19.

hedera-eng-infrastructure requested a review from a team August 2, 2024 05:59

hedera-eng-infrastructure requested review from a team as code owners August 2, 2024 05:59

hedera-eng-infrastructure requested review from jasperpotts and iwsimon August 2, 2024 05:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Fix for 7 vulnerabilities #14552

[Snyk] Fix for 7 vulnerabilities #14552

hedera-eng-infrastructure commented Aug 2, 2024

github-actions bot commented Aug 2, 2024

github-actions bot commented Aug 2, 2024

github-actions bot commented Aug 2, 2024

github-actions bot commented Aug 2, 2024

github-actions bot commented Aug 2, 2024

github-actions bot commented Aug 2, 2024

github-actions bot commented Aug 2, 2024

github-actions bot commented Aug 2, 2024

[Snyk] Fix for 7 vulnerabilities #14552

Are you sure you want to change the base?

[Snyk] Fix for 7 vulnerabilities #14552

Conversation

hedera-eng-infrastructure commented Aug 2, 2024

Snyk has created this PR to fix 7 vulnerabilities in the pip dependencies of this project.

Snyk changed the following file(s):

github-actions bot commented Aug 2, 2024

Node: HAPI Test (Restart) Results

github-actions bot commented Aug 2, 2024

Node: HAPI Test (Token) Results

github-actions bot commented Aug 2, 2024

Node: HAPI Test (Node Death Reconnect) Results

github-actions bot commented Aug 2, 2024

Node: HAPI Test (Crypto) Results

github-actions bot commented Aug 2, 2024

Node: HAPI Test (Smart Contract) Results

github-actions bot commented Aug 2, 2024

Node: HAPI Test (Time Consuming) Results

github-actions bot commented Aug 2, 2024

Node: HAPI Test (Misc) Results

github-actions bot commented Aug 2, 2024

Node: Unit Test Results