Repository navigation
Expand file tree
/
Copy pathosv-scanner.toml
More file actions
41 lines (39 loc) · 1.99 KB
/
Copy pathosv-scanner.toml
File metadata and controls
41 lines (39 loc) · 1.99 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
# OSV-Scanner suppressions for the databricks-sql-python security gate.
#
# Each entry suppresses a CVE that is a documented ecosystem false
# positive against an artifact we ship. Every entry has a justification.
#
# Trade-off worth noting: [[IgnoredVulns]] entries are CVE-id global --
# they ignore the CVE across all packages OSV reports it against, not
# just the artifact we have in mind. The alternative
# ([[PackageOverrides]] with `vulnerability.ignore = true`) is
# per-package but blanket-ignores ALL vulnerabilities on that package,
# which is much worse. OSV-Scanner v2.3.8 does NOT support an
# intersection ("this CVE on this package only").
#
# See google.github.io/osv-scanner/configuration/ for the schema.
#
# This file starts empty -- populate iteratively as the first scan run
# surfaces real false positives. Do not pre-populate with speculative
# suppressions.
[[IgnoredVulns]]
id = "GHSA-g6cj-pr64-35w5"
# CVE-2026-69247 / PYSEC-2026-3552 -- a Bleichenbacher-style timing/error
# oracle in cryptography's PKCS#7 *EnvelopedData* decryption
# (pkcs7_decrypt_der/pem/smime), exploitable only against an endpoint that
# auto-decrypts attacker-supplied S/MIME EnvelopedData and responds
# adaptively. Affects cryptography >=44.0.0,<50.0.0; fixed in 50.0.0.
#
# Not reachable here: `cryptography` is a transitive dependency (via
# PyJWT[crypto] / oauthlib, for OAuth token signing/verification). The
# connector never decrypts PKCS#7 / S/MIME EnvelopedData -- the vulnerable
# code path is never invoked. Pre-existing on main (transitive, not
# introduced by any connector change); a clean bump awaits PyJWT/oauthlib
# floors that pull cryptography>=50. Re-evaluate when the dependency tree
# resolves to a fixed cryptography.
[[IgnoredVulns]]
# Same advisory under its PYSEC alias -- OSV reports both ids for this
# finding, so suppress both to be safe (see GHSA-g6cj-pr64-35w5 above for
# the full justification: unreachable PKCS#7/S-MIME decryption oracle in a
# transitive dependency).
id = "PYSEC-2026-3552"