pip audit dozens of vulnerabilities after
summary
Ran pip-audit across ~50 repositories and finds dozens of advisories, many not exploitable but several actionable: pip itself had archive‑handling bugs, a transitive urllib3 decompression DoS, h11 request‑smuggling that can bypass controls, pillow PSD out‑of‑bounds write exploitable if user images reach the parser, and even pip-audit introduced a TOCTOU bug. Recommendations: add pip-audit to CI, schedule small updates, automate with Dependabot/Renovate, and triage fixes by contextual attack surface.
AI-written summary · about
chapters (7)
- 0:00Supply chain security intro
- 1:28What pip audit is
- 6:56Real vulnerabilities found
- 18:59Trust is recursive
- 19:22Dependency updates daily
- 26:51Three actions Monday
- 27:53Q&A
related talks
28mWhen pip install Is Not Enough: Real Threats and Practical Defenses
29mReducing the "Oops Factor": Pipelines for a Secure Python Development Lifecycle
35mSecuring Python projects Supply Chain
25m"Security considerations in Python Packaging"
26mSecure Software Supply Chains for Python
18mMalicious Needle in a Haystack – PyPi Security Pitfalls
18mContinuous Security - Building Security into your Pipelines
10mUpdate from our Security Engineers