security: PySafeguard 8.0.3 — CVE dep pins and TLS documentation#33
Merged
Merged
Conversation
Member
Author
|
Live verified against 192.168.117.15 admin smoke 2026-05-26. Selected GET-only pytest integration subset passed: 11 passed, 0 failed; mutating suites were intentionally skipped under live-reads-only discipline. Full log: .security-review-impl-logs/live-sweep/py-live.log. ansible-safeguard S5 can now proceed once PyPI publish completes. |
Member
Author
|
Full live appliance sweep re-run (mutation allowed) completed against 192.168.117.15. Results:
Lease released in |
petrsnd
changed the title
Add direct floor pins on transitive deps that have known CVEs at lower versions: - urllib3 >= 2.0.8 fixes CVE-2026-44431 (DNS rebinding) and CVE-2026-44432 (proxy protocol confusion). - idna >= 3.7 fixes CVE-2026-45409 (ReDoS via crafted IDN inputs). Regenerated poetry.lock. Added tests/test_dependency_versions.py to enforce the floors so future poetry resolutions cannot regress below the patched versions.
…cation README section The anonymous sample uses verify=False so it works out of the box against a dev appliance with a self-signed certificate. Make the insecurity intentional and traceable: - Inline WARNING comment in samples/AnonymousExample.py explaining when verify=False is appropriate and pointing back to the README. - New 'TLS Verification' section in README.md describing the verify= options and the production-safe REQUESTS_CA_BUNDLE / CA-bundle pattern. - Regression test that fails if either the inline guidance or the README section disappears.
Audit of exception/response-rendering paths found that ApiError.from_response,
ApiError.from_async_response, and several SafeguardError raises in pkce.py
interpolated the full upstream response body verbatim into the human-facing
exception message. That body is the form that typically reaches logs, crash
reporters, and SIEMs, so it is the leak surface that matters in practice.
Per cross-cutting decision D-013 the chosen mitigation is **truncation**,
not field-level redaction: substring or regex redaction would wrongly mask
legitimate Safeguard payload fields such as PasswordRulesPolicyId,
ApiKeyName, RequirePasswordChange, PasswordHistoryDepth, and
PrivateKeyFormat. The full body remains available to callers via
SafeguardError.response_body for diagnostic use.
Changes:
- errors.py: add _truncate_for_message helper with a 200-char cap and an
explicit '... (truncated, N total chars)' marker. Apply it in both
ApiError.from_response and ApiError.from_async_response.
- pkce.py: route all four raise-SafeguardError sites that interpolated
resp.text through _truncate_for_message.
- tests/test_credential_redaction_audit.py: new regression suite covering
truncation, marker presence, short-body passthrough, response_body
preservation, a static guardrail against future raw {resp.text}
interpolations in pkce.py, and the D-013 negative test ensuring
legitimate API field names survive intact.
…through (C-PySafeguard-001)
petrsnd
force-pushed
the
security/review-20260522-py
branch
from
9afd18f to
aec7cf4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
urllib3 >= 2.0.8(CVE-2026-44431, CVE-2026-44432) andidna >= 3.7(CVE-2026-45409).verifyparameter and production guidance.WARNINGcomment insamples/AnonymousExample.pyexplainingverify=Falseusage.8.0.3.Validation