From 6a05aef33c10253488467b1d1e8bb51d4dc5d528 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Keilyn=20Rodr=C3=ADguez=20Perojo?= <73491750+keilynrp@users.noreply.github.com> Date: Tue, 29 Sep 2026 17:05:38 -0600 Subject: [PATCH] chore(security): ignore CVE-2026-49265 in oauthlib, which UKIP neither ships nor runs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Published 2026-09-29 and failing every PR since: a timing side channel in oauthlib's PKCE code_verifier comparison, fixed in 4.0.0. It is ignored with a disposition in SECURITY_GATES.md §7e, for two independent reasons. oauthlib is lock-only, reached through chromadb -> kubernetes -> requests-oauthlib, and a dry-run install of requirements.txt with the lock resolved 97 packages without any of them. And the flaw is in the authorization server's PKCE check; UKIP issues no OAuth codes, its SSO is an Authlib client, and nothing in backend/ imports oauthlib. Forcing a major oauthlib into the lock under a package the image does not install would buy nothing, so it waits for requests-oauthlib/kubernetes to accept 4.x; review by 2026-10-31. pip-audit 2.10.1 with the six flags: No known vulnerabilities found, 8 ignored. The same run shows the chromadb findings now emitted as PYSEC-2026-3813/3814/3815 rather than the CVE IDs the flags use, still held through aliases; recorded for the baseline review due 2026-09-30. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/security.yml | 7 ++++++- docs/operating/SECURITY_GATES.md | 31 ++++++++++++++++++++++++++++++- 2 files changed, 36 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 4ef9dc78..f144b046 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -48,7 +48,7 @@ jobs: # --no-deps: requirements.lock is a flat freeze (no hashes); pip # resolver is disabled via --disable-pip so no network lookup needed. # - # Five entries, down from 33 at gate introduction. The old list + # Six entries, down from 33 at gate introduction. The old list # deferred most of its entries to "the upgrade sprint"; #202 was # that sprint, and the resulting versions reached or passed every # fix version the baseline recorded, so 31 flags were suppressing @@ -63,6 +63,10 @@ jobs: # CVE-2026-45830/45831/45833), pip-audit's own canonical ID *is* the # CVE — the PyPA advisory DB has no PYSEC entry for them yet — so # these three are pip-audit's real output, not an alias regression. + # CVE-2026-49265 (oauthlib, 2026-09-29) arrives only through + # chromadb -> kubernetes -> requests-oauthlib, none of which the + # backend image installs, and it sits in oauthlib's OAuth *server* + # PKCE check, which UKIP never runs (its SSO is an Authlib client). # See docs/operating/SECURITY_GATES.md §7e for full disposition. run: >- pip-audit -r requirements.lock --disable-pip --no-deps @@ -71,6 +75,7 @@ jobs: --ignore-vuln CVE-2026-45830 --ignore-vuln CVE-2026-45831 --ignore-vuln CVE-2026-45833 + --ignore-vuln CVE-2026-49265 # ── Frontend dependency audit (blocking; allowlist via wrapper) ───────── npm-audit: diff --git a/docs/operating/SECURITY_GATES.md b/docs/operating/SECURITY_GATES.md index 347e612f..2efeb075 100644 --- a/docs/operating/SECURITY_GATES.md +++ b/docs/operating/SECURITY_GATES.md @@ -312,7 +312,7 @@ per-advisory disposition. ### 7e. pip-audit baseline (`--ignore-vuln` flags in `.github/workflows/security.yml`) -**5 vulnerability IDs ignored** (down from 33 at gate introduction). Owner: +**6 vulnerability IDs ignored** (down from 33 at gate introduction). Owner: platform owner. SLA: next dependency-upgrade window (review by 2026-09-30). The previous baseline deferred most entries to "the upgrade sprint", noting in @@ -347,6 +347,35 @@ re-verified by running the tool rather than assumed. | CVE-2026-45830 | chromadb==1.5.2 | none published | 2026-09-30 | | CVE-2026-45831 | chromadb==1.5.2 | none published | 2026-09-30 | | CVE-2026-45833 | chromadb==1.5.2 | none published | 2026-09-30 | +| CVE-2026-49265 | oauthlib==3.3.1 | 4.0.0 (major) | 2026-10-31 | + +**2026-09-29 review: oauthlib, CVE-2026-49265 (GHSA-xpv3-w29h-x7cv).** A +timing side channel in `oauthlib`'s PKCE `code_verifier` comparison +(`oauth2/rfc6749/grant_types/authorization_code.py`, CWE-208), fixed in 4.0.0. +It turned every PR red on the day it was published. Ignored, for two +independent reasons: + +1. **Not shipped.** `oauthlib` is lock-only, reached only through + `chromadb` -> `kubernetes` -> `requests-oauthlib`. A `pip install --dry-run + --report -r requirements.txt -c requirements.lock` on 2026-09-29 resolved 97 + packages without `oauthlib`, `requests-oauthlib`, `kubernetes` or + `chromadb` (run on Python 3.12; the image uses 3.13). +2. **Not reachable.** The flaw is in the authorization *server* verifying a + PKCE verifier. UKIP issues no OAuth authorization codes; its SSO is an + OAuth *client* built on Authlib, and nothing in `backend/` imports + `oauthlib`. + +The fix is a major version under a transitive dependency of a package the +image does not install, so it waits for `requests-oauthlib`/`kubernetes` to +accept 4.x rather than being forced into the lock. Review by 2026-10-31. + +Re-verified with pip-audit 2.10.1: without ignores it reports the rows above; +with all six flags, `No known vulnerabilities found, 8 ignored`. It also shows +drift for the next review (2026-09-30): pip-audit now emits the three chromadb +findings as `PYSEC-2026-3813/3814/3815`, not the CVE IDs the flags use. The +flags still hold them, matched through aliases, which is exactly the silent +failure mode described above; switching those three flags to the canonical +IDs belongs to that review. Note that `chromadb` is a lock-only entry: it constrains dev installs but is not among the packages the backend image installs (`pip install -r requirements.txt