[Snyk] unlimited allocation of resources

[jason-upchurch]

Issue may be related: #3422

Summary

a new security vulnerability was found by snyk. Upgrading pillow will require some wagtail and django[-related] package updates as well, i.e., there are dependency requirements beyond wagtail > pillow.

Allocation of Resources Without Limits or Throttling (new) [Medium Severity
[https://snyk.io/vuln/SNYK-PYTHON-PILLOW-536096] in Pillow@5.4.1
introduced by wagtail@2.2.1 > Pillow@5.4.1

Overview

pillow is a PIL fork.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

Remediation

Upgrade pillow to version 6.2.0 or higher.

Completion Criteria

• identify if used in a way that leaves us vulnerable and fix as needed

[jason-upchurch]

dependency tree for current fec-cms python packages:

boto3==1.7.21
  - botocore [required: >=1.10.21,<1.11.0, installed: 1.10.84]
    - docutils [required: >=0.10, installed: 0.15.2]
    - jmespath [required: >=0.7.1,<1.0.0, installed: 0.9.4]
    - python-dateutil [required: >=2.1,<3.0.0, installed: 2.6.0]
      - six [required: >=1.5, installed: 1.13.0]
  - jmespath [required: >=0.7.1,<1.0.0, installed: 0.9.4]
  - s3transfer [required: >=0.1.10,<0.2.0, installed: 0.1.13]
    - botocore [required: >=1.3.0,<2.0.0, installed: 1.10.84]
      - docutils [required: >=0.10, installed: 0.15.2]
      - jmespath [required: >=0.7.1,<1.0.0, installed: 0.9.4]
      - python-dateutil [required: >=2.1,<3.0.0, installed: 2.6.0]
        - six [required: >=1.5, installed: 1.13.0]
CacheControl==0.11.5
  - requests [required: Any, installed: 2.21.0]
    - certifi [required: >=2017.4.17, installed: 2019.11.28]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.9, installed: 2.8]
    - urllib3 [required: >=1.21.1,<1.25, installed: 1.24.3]
cachetools==1.0.2
cfenv==0.5.2
  - furl [required: >=0.4.8, installed: 2.1.0]
    - orderedmultidict [required: >=1.0.1, installed: 1.0.1]
      - six [required: >=1.8.0, installed: 1.13.0]
    - six [required: >=1.8.0, installed: 1.13.0]
cg-django-uaa==1.3.0
  - django [required: >=1.8,<2.1, installed: 1.11.23]
    - pytz [required: Any, installed: 2019.3]
  - PyJWT [required: >=1.4.2, installed: 1.7.1]
  - requests [required: >=2.11.0, installed: 2.21.0]
    - certifi [required: >=2017.4.17, installed: 2019.11.28]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.9, installed: 2.8]
    - urllib3 [required: >=1.21.1,<1.25, installed: 1.24.3]
dj-database-url==0.4.2
django-audit-log==0.7.0
django-jinja==2.4.1
  - django [required: >=1.8, installed: 1.11.23]
    - pytz [required: Any, installed: 2019.3]
  - jinja2 [required: >=2.5, installed: 2.10.1]
    - MarkupSafe [required: >=0.23, installed: 1.1.1]
django-libsass==0.7
  - django-compressor [required: >=1.3, installed: 2.3]
    - django-appconf [required: >=1.0, installed: 1.0.3]
      - django [required: Any, installed: 1.11.23]
        - pytz [required: Any, installed: 2019.3]
      - six [required: Any, installed: 1.13.0]
    - rcssmin [required: ==1.0.6, installed: 1.0.6]
    - rjsmin [required: ==1.1.0, installed: 1.1.0]
  - libsass [required: >=0.7.0, installed: 0.19.4]
    - six [required: Any, installed: 1.13.0]
django-storages==1.7.1
  - Django [required: >=1.11, installed: 1.11.23]
    - pytz [required: Any, installed: 2019.3]
Faker==0.8.6
  - python-dateutil [required: >=2.4, installed: 2.6.0]
    - six [required: >=1.5, installed: 1.13.0]
  - six [required: Any, installed: 1.13.0]
  - text-unidecode [required: Any, installed: 1.3]
gevent==1.2.1
  - greenlet [required: >=0.4.10, installed: 0.4.15]
github3.py==0.9.6
  - requests [required: >=2.0, installed: 2.21.0]
    - certifi [required: >=2017.4.17, installed: 2019.11.28]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.9, installed: 2.8]
    - urllib3 [required: >=1.21.1,<1.25, installed: 1.24.3]
  - uritemplate.py [required: >=0.2.0, installed: 3.0.2]
    - uritemplate [required: >=2.0, installed: 3.0.0]
GitPython==1.0.1
  - gitdb [required: >=0.6.4, installed: 0.6.4]
    - smmap [required: >=0.8.5, installed: 0.9.0]
gunicorn==19.7.1
invoke==0.15.0
lxml==4.2.5
pdbpp==0.9.1
  - fancycompleter [required: >=0.2, installed: 0.8]
  - pygments [required: Any, installed: 2.5.2]
  - wmctrl [required: Any, installed: 0.3]
pipdeptree==0.13.2
  - pip [required: >=6.0.0, installed: 18.1]
psycopg2==2.7.3.2
pytest-cov==2.5.1
  - coverage [required: >=3.7.1, installed: 4.5.1]
  - pytest [required: >=2.6.0, installed: 3.7.4]
    - atomicwrites [required: >=1.0, installed: 1.3.0]
    - attrs [required: >=17.4.0, installed: 19.3.0]
    - more-itertools [required: >=4.0.0, installed: 7.2.0]
    - pluggy [required: >=0.7, installed: 0.13.1]
      - importlib-metadata [required: >=0.12, installed: 0.23]
        - zipp [required: >=0.5, installed: 0.6.0]
          - more-itertools [required: Any, installed: 7.2.0]
    - py [required: >=1.5.0, installed: 1.8.0]
    - setuptools [required: Any, installed: 40.6.2]
    - six [required: >=1.10.0, installed: 1.13.0]
pytest-django==3.4.2
  - pytest [required: >=3.6, installed: 3.7.4]
    - atomicwrites [required: >=1.0, installed: 1.3.0]
    - attrs [required: >=17.4.0, installed: 19.3.0]
    - more-itertools [required: >=4.0.0, installed: 7.2.0]
    - pluggy [required: >=0.7, installed: 0.13.1]
      - importlib-metadata [required: >=0.12, installed: 0.23]
        - zipp [required: >=0.5, installed: 0.6.0]
          - more-itertools [required: Any, installed: 7.2.0]
    - py [required: >=1.5.0, installed: 1.8.0]
    - setuptools [required: Any, installed: 40.6.2]
    - six [required: >=1.10.0, installed: 1.13.0]
requests-mock==1.3.0
  - requests [required: >=1.1, installed: 2.21.0]
    - certifi [required: >=2017.4.17, installed: 2019.11.28]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.9, installed: 2.8]
    - urllib3 [required: >=1.21.1,<1.25, installed: 1.24.3]
  - six [required: Any, installed: 1.13.0]
slacker==0.8.6
  - requests [required: >=2.2.1, installed: 2.21.0]
    - certifi [required: >=2017.4.17, installed: 2019.11.28]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.9, installed: 2.8]
    - urllib3 [required: >=1.21.1,<1.25, installed: 1.24.3]
unicode-slugify==0.1.3
  - six [required: Any, installed: 1.13.0]
  - unidecode [required: Any, installed: 1.1.1]
wagtail==2.2.1
  - beautifulsoup4 [required: >=4.5.1,<4.6.1, installed: 4.5.1]
  - Django [required: >=1.11,<2.1, installed: 1.11.23]
    - pytz [required: Any, installed: 2019.3]
  - django-modelcluster [required: >=4.0,<5.0, installed: 4.4]
    - pytz [required: >=2015.2, installed: 2019.3]
  - django-taggit [required: >=0.22.2,<1.0, installed: 0.24.0]
    - Django [required: >=1.11, installed: 1.11.23]
      - pytz [required: Any, installed: 2019.3]
  - django-treebeard [required: >=4.2.0,<5.0, installed: 4.3]
    - Django [required: >=1.8, installed: 1.11.23]
      - pytz [required: Any, installed: 2019.3]
  - djangorestframework [required: >=3.7.4,<4.0, installed: 3.10.3]
  - draftjs-exporter [required: >=2.0,<3.0, installed: 2.1.7]
  - html5lib [required: >=0.999,<2, installed: 1.0.1]
    - six [required: >=1.9, installed: 1.13.0]
    - webencodings [required: Any, installed: 0.5.1]
  - Pillow [required: >=4.0.0,<6.0, installed: 5.4.1]
  - pytz [required: >=2016.6, installed: 2019.3]
  - requests [required: >=2.11.1,<3.0, installed: 2.21.0]
    - certifi [required: >=2017.4.17, installed: 2019.11.28]
    - chardet [required: >=3.0.2,<3.1.0, installed: 3.0.4]
    - idna [required: >=2.5,<2.9, installed: 2.8]
    - urllib3 [required: >=1.21.1,<1.25, installed: 1.24.3]
  - six [required: >=1.11,<2.0, installed: 1.13.0]
  - Unidecode [required: >=0.04.14,<2.0, installed: 1.1.1]
  - Willow [required: >=1.1,<1.2, installed: 1.1]
whitenoise==2.0.3

[patphongs]

In order to upgrade pillow to the remediated package version 6.2.0, we need to upgrade the wagtail package to at least v2.6 and Django to at least v2.0 or higher.

[patphongs]

After consulting with the team, this package does not cause a significant external security vulnerability since only approved and authenticated Wagtail users can upload resources to our system. We plan to patch this package when we upgrade our django and wagtail versions. See issue #3105.

[pkfec]

Pillow pkg is also updated to v6.2.2. Wagtail is updated to LTS v2.7 in PR #3563.
PR #3563 is merged. Closing this issue.