Dante Catalfamo
e90bcfeaae
**Related issue:** Resolves #35148 ## What was added | CVE | Rule | Reason | |-----|------|--------| | **CVE-2017-17522** | `IgnoreAll` | DISPUTED by Python maintainers; not exploitable (`webbrowser.py` uses `subprocess.Popen` with `shell=False`). Broad NVD CPE matched modern Python. | | **CVE-2023-36632** | `IgnoreAll` | NVD-DISPUTED — Python states it's "neither a vulnerability nor a bug" (intentional `RecursionError` in `email.utils.parseaddr`). | | **CVE-2024-3219** | `IgnoreIf target_sw != "windows"` | Only affects platforms lacking AF_UNIX (Windows). Linux/macOS unaffected, but NVD/VulnCheck CPE uses `target_sw=*`. | **Files touched:** - `cpe_matching_rules.go` — three new rules - `cpe_matching_rule_test.go` — assertions covering all three (incl. Windows-vs-macOS/Linux distinction for CVE-2024-3219) - `changes/35148-python-cve-false-positives` — changelog **Correctness note:** `target_sw` derives from software *source* (`apps`/`homebrew_packages` → `macos`, `programs` → `windows`), so the CVE-2024-3219 rule suppresses on macOS while preserving the genuine Windows positive. ## What was skipped, and why | CVE | Why skipped | |-----|-------------| | **CVE-2024-12718** | Conflicting evidence: getvictor confirmed it's a **true positive** (3.9.22 < fixed 3.9.23), contradicting the customer's "only 3.12+ affected" reasoning. Needs a product/security ruling, not a code change. | | **CVE-2025-1795** | Likely a VulnCheck patch-level miss (customer says 3.10.17 has the backported fix). Needs the actual VulnCheck version range to fix safely. | | **CVE-2023-32681** | Affects `python:requests` and is **correctly matched**; the customer dismissed it on deployment grounds ("corporate servers only"). Not a detection bug. | | **CVE-2007-4559** | Real tarfile path-traversal (CVSS 9.8, **not disputed**); the customer labeled it "Other issue," not a false positive. Suppressing it would hide a genuine vulnerability. |
4 lines
379 B
Plaintext
4 lines
379 B
Plaintext
* Fixed false positive vulnerability CVE-2017-17522 reported for Python (this CVE is disputed and not exploitable).
|
|
* Fixed false positive vulnerability CVE-2023-36632 reported for Python (this CVE is disputed; the reported behavior is intentional).
|
|
* Fixed false positive vulnerability CVE-2024-3219 reported for Python on macOS and Linux hosts (this CVE only affects Windows).
|