有关pip-audit

pip-audit是一款功能齐全的安全性漏洞扫描工具，该工具关键对于Python环境，可以协助众多科学研究工作人员扫描仪和检测Python库中的已经知道网络安全问题。pip-audit应用了PythonPackagingAdvisory数据库查询PyPIJSONAPI做为系统漏洞汇报源。

功能介绍

1、支持对当地环境和依靠部件（requirements设计风格文档）开展网络安全审计；

2、支持多种多样系统漏洞服务项目（PyPI、OSV）；

3、支持以CycloneDX XML或JSON格式推送SBOM；

4、给予人们和设备均可读的輸出格式（columnar、JSON）；

5、无缝拼接连接 / 器重当地pip缓存文件；

工具安装

pip-audit根据Python开发设计，且规定当地环境为Python 3.7或更新版本。安装并配备好Python环境以后，就可以应用以下指令并根据pip来安装pip-audit了：

python -m pip install pip-audit

第三方包

pip-audit的正常的运作必须应用到好几个第三方包，实际部件包名字和版本号如下图所示：

此外，大家也可以根据conda来安装pip-audit：

conda install -c conda-forge pip-audit

工具应用

我们可以立即将pip-audit以单独程序执行，或根据“python -m”运作：

pip-audit --help

python -m pip_audit --help

usage: pip-audit [-h] [-V] [-l] [-r REQUIREMENTS] [-f FORMAT] [-s SERVICE]

                 [-d] [-S] [--desc [{on,off,auto}]] [--cache-dir CACHE_DIR]

                 [--progress-spinner {on,off}] [--timeout TIMEOUT]

                 [--path PATHS] [-v] [--fix] [--require-hashes]

audit the Python environment for dependencies with known vulnerabilities

optional arguments:

  -h, --help            show this help message and exit

  -V, --version         show program\'s version number and exit

  -l, --local           show only results for dependencies in the local

                        environment (default: False)

  -r REQUIREMENTS, --requirement REQUIREMENTS

                        audit the given requirements file; this option can be

                        used multiple times (default: None)

  -f FORMAT, --format FORMAT

                        the format to emit audit results in (choices: columns,

                        json, cyclonedx-json, cyclonedx-xml) (default:

                        columns)

  -s SERVICE, --vulnerability-service SERVICE

                        the vulnerability service to audit dependencies

                        against (choices: osv, pypi) (default: pypi)

  -d, --dry-run         without `--fix`: collect all dependencies but do not

                        perform the auditing step; with `--fix`: perform the

                        auditing step but do not perform any fixes (default:

                        False)

  -S, --strict          fail the entire audit if dependency collection fails

                        on any dependency (default: False)

  --desc [{on,off,auto}]

                        include a description for each vulnerability; `auto`

                        defaults to `on` for the `json` format. This flag has

                        no effect on the `cyclonedx-json` or `cyclonedx-xml`

                        formats. (default: auto)

  --cache-dir CACHE_DIR

                        the directory to use as an HTTP cache for PyPI; uses

                        the `pip` HTTP cache by default (default: None)

  --progress-spinner {on,off}

                        display a progress spinner (default: on)

  --timeout TIMEOUT     set the socket timeout (default: 15)

  --path PATHS          restrict to the specified installation path for

                        auditing packages; this option can be used multiple

                        times (default: [])

  -v, --verbose         give more output; this setting overrides the

                        `PIP_AUDIT_LOGLEVEL` variable and is equivalent to

                        setting it to `debug` (default: False)

  --fix                 automatically upgrade dependencies with known

                        vulnerabilities (default: False)

  --require-hashes      require a hash to check each requirement against, for

                        repeatable audits; this option is implied when any

                        package in a requirements file has a `--hash` option.

                        (default: False)

撤出编码

任务完成后， pip-audit可能撤出运作，并回到一个编码以展现其情况，在其中：

0：未监测到已经知道系统漏洞；

1：检验到了一个或数个已经知道系统漏洞；

工具应用示例

财务审计现阶段Python环境中的依靠：

$ pip-audit

No known vulnerabilities found

财务审计给出requirements文件的依靠：

$ pip-audit -r ./requirements.txt

No known vulnerabilities found

财务审计一个requirements文件，并清除系统软件包：

$ pip-audit -r ./requirements.txt -l

No known vulnerabilities found

财务审计依靠中发觉的网络安全问题：

$ pip-audit

Found 2 known vulnerabilities in 1 package

Name  Version ID             Fix Versions

----  ------- -------------- ------------

Flask 0.5     PYSEC-2019-179 1.0

Flask 0.5     PYSEC-2018-66  0.12.3

审计依赖（包含描述）：

$ pip-audit --desc

Found 2 known vulnerabilities in 1 package

Name  Version ID             Fix Versions Description

----  ------- -------------- ------------ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Flask 0.5     PYSEC-2019-179 1.0          The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.

Flask 0.5     PYSEC-2018-66  0.12.3       The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.

审计JSON格式依赖：

$ pip-audit -f json | jq

Found 2 known vulnerabilities in 1 package

[

  {

    \"name\": \"flask\",

    \"version\": \"0.5\",

    \"vulns\": [

      {

        \"id\": \"PYSEC-2019-179\",

        \"fix_versions\": [

          \"1.0\"

        ],

        \"description\": \"The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.\"

      },

      {

        \"id\": \"PYSEC-2018-66\",

        \"fix_versions\": [

          \"0.12.3\"

        ],

        \"description\": \"The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.\"

      }

    ]

  },

  {

    \"name\": \"jinja2\",

    \"version\": \"3.0.2\",

    \"vulns\": []

  },

  {

    \"name\": \"pip\",

    \"version\": \"21.3.1\",

    \"vulns\": []

  },

  {

    \"name\": \"setuptools\",

    \"version\": \"57.4.0\",

    \"vulns\": []

  },

  {

    \"name\": \"werkzeug\",

    \"version\": \"2.0.2\",

    \"vulns\": []

  },

  {

    \"name\": \"markupsafe\",

    \"version\": \"2.0.1\",

    \"vulns\": []

  }

]

【一>全部資源关注我，私聊回应“材料”获得<一】
1、网络安全学习线路
2、电子书（白帽）
3、安全性大型厂内部结构短视频
4、100份src文本文档
5、普遍安全性面试问题
6、ctf大赛經典题型分析
7、整套工具箱
8、应急处置手记

审计并试着全自动审计存有系统漏洞的依赖：

$ pip-audit --fix

Found 2 known vulnerabilities in 1 package and fixed 2 vulnerabilities in 1 package

Name  Version ID             Fix Versions Applied Fix

----- ------- -------------- ------------ ----------------------------------------

flask 0.5     PYSEC-2019-179 1.0          Successfully upgraded flask (0.5 => 1.0)

flask 0.5     PYSEC-2018-66  0.12.3       Successfully upgraded flask (0.5 => 1.0)

许可证书协议书

本工程项目的研发与公布遵循 Apache 2.0开源系统许可证书协议书。