Any plan to fix CVE-2022-30284 [Critical] - python-libnmap 0.7.2 ?

[ajaySec]

Would like to know if there is any plan on fixing CVE-2022-30284 in python-libnmap pack 0.7.2 for Python ? This library is part of scheduled network scan in my org so require action on this

[underdarknl]

It looks like there is no active maintenance on this module at the moment, as no valid commits have been made for about a year, and obvious issues (black issue) on the last commits have not been addressed. It looks like a fork would be useful at this point. Seeing that this lib also contains a whole lot of application code its not really a lib anymore, and would benefit from being a little bit smaller and broken into smaller parts.

Judging by the response noted on the CVE page, a fix is not forthcoming.

NOTE: the vendor believes it would be unrealistic for an application to call NmapProcess with arguments taken from input data that arrived over an untrusted network, and thus the CVSS score corresponds to an unrealistic use case. None of the NmapProcess documentation implies that this is an expected use case.

Seeing that the author feels no need to mitigate against this very easily exploited issue should send shockwaves to any user of this lib.

[savon-noir]

Just a note here, I don't exactly know where this dispute quote comes from but these are not my words. When the bug hunter found the issue, I've accepted it as a security issue but could not provide a fix short/mid-term. Since he was waiting for publication of the issue I said the following:

Bug hunter: "Ok, I'm waiting for the new release." Yours truly: "ok, but you can already apply for cve and disclose if you want. its not really a problem. I think there are enough means to ensure proper inputs are passed to the lib if being used otherwise."

Which translates to: since this lib (or helper if you prefer to call it like that) would most likely be interfaced, filtering should be straight forward for the developers using it.

Hope it clarifies.

[savon-noir]

It looks like a fork would be useful at this point. Seeing that this lib also contains a whole lot of application code its not really a lib anymore, and would benefit from being a little bit smaller and broken into smaller parts.

@underdarknl interesting proposal! Now the world is waiting for your PR and/or your refactoring of the lib/helper. Keep me posted on your progresses.

regards, Ronald