vulncheck
4c2a1fb86a
A Grype scan of the backend image reported 1576 findings, 16 critical. Most came from build headers nothing uses: every requirement ships a wheel (xmlsec and lxml bundle their own libxml2 2.14), so libxml2-dev, libxmlsec1-dev, libsasl2-dev, libldap2-dev, libssl-dev and pkg-config only pulled in linux-libc-dev (1161 findings), libunbound8 and Debian's libxml2. The rest were Debian fixes the python:3.11-slim base had not picked up yet (perl, libc6, gzip, pcre2, sqlite, libevent) and old pip / setuptools / wheel. The image now runs apt-get upgrade, upgrades pip, setuptools and wheel, and installs requirements with --only-binary=:all:, so a requirement without a wheel fails the build instead of needing a compiler. Rebuilt image: 187 findings, none critical, no High with a fix available; the remaining fixable ones are Python 3.11 CVEs fixed only in 3.13+. App import, SAML/xmlsec and the test suite run inside the image.
77 lines
2.1 KiB
Plaintext
77 lines
2.1 KiB
Plaintext
# VulnManager Dependencies (Python 3.13 kompatibel)
|
|
|
|
# FastAPI & Server
|
|
# fastapi 0.115.6 hat starlette auf <0.42 festgenagelt — und genau dort
|
|
# hingen 14 Advisories. Die Starlette-Aktualisierung geht nur über fastapi.
|
|
fastapi==0.141.1
|
|
uvicorn[standard]==0.32.1
|
|
python-multipart==0.0.32
|
|
|
|
# Database
|
|
sqlalchemy==2.0.36
|
|
alembic==1.14.0
|
|
psycopg2-binary==2.9.10 # Updated für Python 3.13
|
|
|
|
# Authentication & Security
|
|
pyjwt[crypto]==2.13.0
|
|
bcrypt==5.0.0 # direkt genutzt (app/auth/jwt_handler.py); passlib ist raus
|
|
|
|
# HTTP Clients
|
|
httpx==0.28.1 # Updated
|
|
tenacity==9.0.0 # Updated
|
|
|
|
# Rate Limiting
|
|
slowapi==0.1.9
|
|
|
|
# Validation
|
|
pydantic==2.10.5 # Updated für Python 3.13
|
|
pydantic-settings==2.7.1 # Updated
|
|
email-validator==2.2.0 # Updated
|
|
|
|
# Scheduling
|
|
apscheduler==3.10.4
|
|
|
|
# Environment
|
|
python-dotenv==1.2.2
|
|
|
|
# Logging & Monitoring (optional)
|
|
python-json-logger==3.2.1 # Updated
|
|
|
|
# Testing (Development)
|
|
pytest==9.1.1
|
|
pytest-asyncio==1.4.0 # verlangt pytest>=8.4
|
|
|
|
# Reporting
|
|
reportlab==4.4.9
|
|
|
|
# ============================================
|
|
# Multi-provider authentication (Phase 1: foundation; Phase 2+: LDAP/OIDC/SAML)
|
|
# ============================================
|
|
# TOTP / MFA
|
|
pyotp==2.9.0
|
|
# Fernet for encrypting LDAP bind-pw + TOTP secrets at rest
|
|
cryptography==50.0.0
|
|
|
|
# LDAPS (Phase 2)
|
|
ldap3==2.9.1
|
|
|
|
# OAuth2 / OIDC (Phase 3)
|
|
authlib==1.7.2
|
|
itsdangerous==2.2.0
|
|
|
|
# SAML 2.0 (Phase 4) — xmlsec / lxml wheels bundle libxml2 + xmlsec1, no system libs
|
|
python3-saml==1.16.0
|
|
# lxml parst hier NICHT die Advisory-Feeds (die laufen über stdlib
|
|
# xml.etree.ElementTree), sondern Microsoft-HTML in m365_service.py.
|
|
lxml==6.1.1
|
|
|
|
# Microsoft product-lifecycle EOL export parsing (Plan O) — reads the
|
|
# monthly eos-product-listing .xlsx from download.microsoft.com.
|
|
openpyxl==3.1.5
|
|
|
|
# VMware vSphere inventory (vCenter connector). Broadcom's own SDK, and the
|
|
# only practical way to read a per-host BUILD number: the vCenter REST API's
|
|
# /api/vcenter/host returns name and power state and no version at all, while
|
|
# every VMware advisory states its fix as a build ("ESXi80U3k-25595708").
|
|
pyvmomi==9.1.0.0
|