koji

#3964 Fix bandit xmlrpc issue
Closed: Fixed by tkopecek. Opened by tkopecek.

Closed: Fixed
Reopen Issue 
>> Issue: [B411:blacklist] Using xmlrpc.client to parse untrusted XML data is known to be vulnerable to XML attacks. Use defused.xmlrpc.monkey_patch() function to monkey-patch xmlrpclib andmitigate XML vulnerabilities.
Severity: High   Confidence: High
CWE: CWE-20 (https://cwe.mitre.org/data/definitions/20.html)
More Info: https://bandit.readthedocs.io/en/1.7.6/blacklists/blacklist_imports.html#b411-import-xmlrpclib

I've not got through that code yet, we can either use it (another dependency :-() or fix it in our code or ignore the check.

Note, that python-defusedxml is available in EPEL in 6/7/8/9, so it we are safe from maintenance POV.

Metadata Update from @tkopecek:
- Custom field Size adjusted to None

Metadata Update from @tkopecek:
- Issue tagged with: discussion

here is a candidate: PR #3975

Metadata Update from @tkopecek:
- Issue untagged with: discussion
- Issue tagged with: testing-ready

Metadata Update from @relias-redhat:
- Issue tagged with: testing-done

Commit 91cf2b50 fixes this issue

Commit f41b8c70 fixes this issue

Metadata Update from @tkopecek:
- Issue set to the milestone: 1.34.1 (was: 1.35)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/3964

Please continue any further discussion there.
Metadata
None

testing-done testing-ready

None
None
Low
None
Related Pull Requests
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.