基础信息
项目名称：zatosource/zato
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1720331773168488448/1720331773696970752
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| Django UsernameField NFKC 规范化存在拒绝服务漏洞 | 拒绝服务 | MPS-1aez-c2qo | CVE-2023-46695 | 中危 |
| Suds cache.py文件安全漏洞 | 在文件访问前对链接解析不恰当（链接跟随） | MPS-2013-3621 | CVE-2013-2217 | 低危 |
| Python 资源管理错误漏洞 | 数值计算不正确 | MPS-2020-15181 | CVE-2020-14422 | 中危 |
| UltraJSON 安全漏洞 | 越界写入 | MPS-2021-40089 | CVE-2021-45958 | 中危 |
| Python 输入验证错误漏洞 | MPS-2021-6340 | CVE-2021-29921 | 严重 | |
| dateparser 存在拒绝服务漏洞 | 拒绝服务 | MPS-2022-14825 | 低危 | |
| ipaddress 存在密码算法不安全漏洞 | 密码算法不安全 | MPS-2022-14951 | 中危 | |
| passlib 存在弱口令要求漏洞 | 弱口令要求 | MPS-2022-15020 | 中危 | |
| OpenSSL 安全漏洞 | 通过差异性导致的信息暴露 | MPS-2022-66954 | CVE-2022-4304 | 中危 |
| OpenSSL 资源管理错误漏洞 | 双重释放 | MPS-2022-67892 | CVE-2022-4450 | 高危 |
| OpenSSL 资源管理错误漏洞 | UAF | MPS-2023-1276 | CVE-2023-0215 | 高危 |
| OpenSSL拒绝服务漏洞(X.509 GeneralName类型混淆) | 不正确的类型转换 | MPS-2023-1620 | CVE-2023-0286 | 高危 |
| OpenSSL 验证 X.509 策略约束存在拒绝服务漏洞 | 拒绝服务 | MPS-2023-2810 | CVE-2023-0464 | 中危 |
| OpenSSL 信任管理问题漏洞 | 证书验证不恰当 | MPS-2023-2811 | CVE-2023-0465 | 中危 |
| OpenSSL 存在证书验证不当 | 证书验证不恰当 | MPS-2023-2812 | CVE-2023-0466 | 中危 |
| PyPI仓库selenium组件包内嵌恶意代码 | 内嵌恶意代码 | MPS-52me-b76a | 高危 | |
| Elasticsearch 安全漏洞 | 日志敏感信息泄露 | MPS-5tmh-3n24 | CVE-2023-31417 | 中危 |
| OpenSSL ASN.1对象标识符转换拒绝服务漏洞 | 拒绝服务 | MPS-9dro-82lx | CVE-2023-2650 | 中危 |
| OpenSSL 安全漏洞 | 过度迭代 | MPS-n3pe-ljgc | CVE-2023-3817 | 中危 |
| OpenSSL在Windows中POLY1305 MAC破坏XMM寄存器导致拒绝服务 | 硬件寄存器清零不当 | MPS-yczn-dfs2 | CVE-2023-4807 | 中危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| selenium | 4.2.0 | 间接依赖 | 强烈建议修复 | |
| suds | 1.0.0 | 间接依赖 | 建议修复 | |
| Django | 4.1.10 | 4.1.13 | 间接依赖 | 建议修复 |
| openssl | 1.1.1q | 1.1.1w | 间接依赖 | 建议修复 |
| ipaddress | 1.0.16 | 间接依赖 | 建议修复 | |
| passlib | 1.7.1 | 1.7.3 | 间接依赖 | 可选修复 |
| elasticsearch | 7.15.2 | 间接依赖 | 可选修复 | |
| dateparser | 0.7.6 | 间接依赖 | 可选修复 | |
| ujson | 5.6.0 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| MIT | 49 | 低 |
| 自定义许可证 | 42 | 低 |
| LGPL-3.0 | 1 | 中 |
| Apache-2.0 | 20 | 低 |
| BSD-3-Clause | 9 | 低 |
| WTFPL | 1 | 低 |
| OpenSSL | 1 | 低 |
| Python-2.0 | 1 | 低 |
| Apache-2.0 OR BSD-3-Clause | 1 | 低 |
| Apache-2.0 OR MIT | 1 | 低 |
| BSD-2-Clause | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| convertdate | 2.0.3.1 | 间接依赖 | pip |
| repoze.lru | 0.6 | 间接依赖 | pip |
| candv | 1.3.1 | 间接依赖 | pip |
| ldap3 | 2.8.1 | 间接依赖 | pip |
| api-ms-win-crt-filesystem-l1-1-0.dll | 间接依赖 | ||
| iso8601 | 0.1.10 | 间接依赖 | pip |
| python-memcached | 1.59 | 间接依赖 | pip |
| pyyaml | 6.0 | 间接依赖 | pip |
| python310.dll | 间接依赖 | ||
| PyMySQL | 1.0.2 | 间接依赖 | pip |
| WebHelpers | 1.3 | 间接依赖 | pip |
| asn1crypto | 0.21.0 | 间接依赖 | pip |
| slackclient | 1.3.1 | 间接依赖 | pip |
| twilio | 7.15.3 | 间接依赖 | pip |
| wsaccel | 0.6.4 | 间接依赖 | pip |
| sortedcontainers | 2.4.0 | 间接依赖 | pip |
| api-ms-win-crt-math-l1-1-0.dll | 间接依赖 | ||
| pymongo | 4.2.0 | 间接依赖 | pip |
| dacite | 1.6.0 | 间接依赖 | pip |
| base32-crockford | 0.3.0 | 间接依赖 | pip |
| umalqurra | 0.2 | 间接依赖 | pip |
| pbr | 5.11.1 | 间接依赖 | pip |
| lxml | 4.9.1 | 间接依赖 | pip |
| oslo.config | 9.0.0 | 间接依赖 | pip |
| distro | 1.5.0 | 间接依赖 | pip |
| python-stdnum | 1.14 | 间接依赖 | pip |
| hl7 | 0.4.1 | 间接依赖 | pip |
| zato-ext-python-tds | 1.11.1 | 间接依赖 | pip |
| google-api-python-client | 2.52.0 | 间接依赖 | pip |
| jsonpatch | 1.23 | 间接依赖 | pip |
| python-ntlm | 1.1.0 | 间接依赖 | pip |
| pyftpdlib | 1.5.7 | 间接依赖 | pip |
| ujson | 5.6.0 | 间接依赖 | pip |
| decorator | 5.1.0 | 间接依赖 | pip |
| dateparser | 0.7.6 | 间接依赖 | pip |
| bcrypt.dll | 间接依赖 | ||
| zope.event | 4.5.0 | 间接依赖 | pip |
| ipaddress | 1.0.16 | 间接依赖 | pip |
| stevedore | 3.5.0 | 间接依赖 | pip |
| parse | 1.6.6 | 间接依赖 | pip |
| api-ms-win-crt-stdio-l1-1-0.dll | 间接依赖 | ||
| idna | 3.3 | 间接依赖 | pip |
| PyJWT | 2.5.0 | 间接依赖 | pip |
| wrapt | 1.14.1 | 间接依赖 | pip |
| recommonmark | 0.6.0 | 间接依赖 | pip |
| requests | 2.31.0 | 间接依赖 | pip |
| typing-utils | 0.1.0 | 间接依赖 | pip |
| stroll | 1.1.0 | 间接依赖 | pip |
| psutil | 5.9.4 | 间接依赖 | pip |
| flake8 | 4.0.1 | 间接依赖 | pip |
| jsonschema | 4.18.0 | 间接依赖 | pip |
| repoze.profile | 2.3 | 间接依赖 | pip |
| globre | 0.1.5 | 间接依赖 | pip |
| kombu | 5.0.2 | 间接依赖 | pip |
| redis | 4.5.4 | 间接依赖 | pip |
| dill | 0.2.5 | 间接依赖 | pip |
| google-auth-oauthlib | 0.5.2 | 间接依赖 | pip |
| Paste | 3.5.2 | 间接依赖 | pip |
| geventhttpclient | 2.0.8 | 间接依赖 | pip |
| regex | 2022.3.2 | 间接依赖 | pip |
| api-ms-win-crt-utility-l1-1-0.dll | 间接依赖 | ||
| coverage | 3.7.1 | 间接依赖 | pip |
| pyright | 1.1.266 | 间接依赖 | pip |
| Django | 4.1.10 | 间接依赖 | pip |
| python-dateutil | 2.8.2 | 间接依赖 | pip |
| sphinx | 4.2.0 | 间接依赖 | pip |
| pytz | 2020.1 | 间接依赖 | pip |
| pyprof2calltree | 1.4.5 | 间接依赖 | pip |
| KERNEL32.dll | 间接依赖 | ||
| parse-type | 0.3.4 | 间接依赖 | pip |
| zato-redis-paginator | 1.0 | 间接依赖 | pip |
| fastparquet | 2022.11.0 | 间接依赖 | pip |
| MarkupSafe | 2.1.1 | 间接依赖 | pip |
| atlassian-python-api | 3.19 | 间接依赖 | pip |
| ndg-httpsclient | 0.4.0 | 间接依赖 | pip |
| boto | 2.49.0 | 间接依赖 | pip |
| VERSION.dll | 间接依赖 | ||
| pyaml | 20.4.0 | 间接依赖 | pip |
| flatbuffers | 1.12 | 间接依赖 | pip |
| gevent | 23.9.1 | 间接依赖 | pip |
| api-ms-win-crt-locale-l1-1-0.dll | 间接依赖 | ||
| py-cpuinfo | 3.3.0 | 间接依赖 | pip |
| codegen | 1.0 | 间接依赖 | pip |
| tzlocal | 4.0 | 间接依赖 | pip |
| greenlet | 3.0.0 | 间接依赖 | pip |
| api-ms-win-crt-time-l1-1-0.dll | 间接依赖 | ||
| faker | 8.12.1 | 间接依赖 | pip |
| Textarea | 间接依赖 | pip | |
| cffi | 1.15.0 | 间接依赖 | pip |
| selenium | 4.2.0 | 间接依赖 | pip |
| raven | 5.1.1 | 间接依赖 | pip |
| fs | 2.4.16 | 间接依赖 | pip |
| urllib3 | 1.26.18 | 间接依赖 | pip |
| simplejson | 3.17.6 | 间接依赖 | pip |
| openssl | 1.1.1q | 间接依赖 | |
| SQLAlchemy | 1.3.19 | 间接依赖 | pip |
| tabulate | 0.9.0 | 间接依赖 | pip |
| pyflakes | 2.4.0 | 间接依赖 | pip |
| markdown | 3.3.4 | 间接依赖 | pip |
| vine | 5.0.0 | 间接依赖 | pip |
| apispec | 5.1.1 | 间接依赖 | pip |
| humanize | 3.0.1 | 间接依赖 | pip |
| odoo-client-lib | 1.2.2 | 间接依赖 | pip |
| watchdog | 0.9.0 | 间接依赖 | pip |
| WS2_32.dll | 间接依赖 | ||
| requests-toolbelt | 0.9.1 | 间接依赖 | pip |
| dropbox | 10.10.0 | 间接依赖 | pip |
| cpython | 3.10.0 | 间接依赖 | |
| pyOpenSSL | 23.2.0 | 间接依赖 | pip |
| ADVAPI32.dll | 间接依赖 | ||
| hiredis | 0.3.1 | 间接依赖 | pip |
| amqp | 5.1.1 | 间接依赖 | pip |
| zato-ext-simple-rbac | 0.1.1 | 间接依赖 | pip |
| o365 | 2.0.26 | 间接依赖 | pip |
| jsonpointer | 2.0 | 间接依赖 | pip |
| configparser | 3.7.1 | 间接依赖 | pip |
| netaddr | 0.8.0 | 间接依赖 | pip |
| dataclasses-jsonschema | 2.15.0 | 间接依赖 | pip |
| pyparsing | 2.4.2 | 间接依赖 | pip |
| pygments | 2.15.0 | 间接依赖 | pip |
| api-ms-win-crt-process-l1-1-0.dll | 间接依赖 | ||
| prettytable | 3.5.0 | 间接依赖 | pip |
| mccabe | 0.6.1 | 间接依赖 | pip |
| docformatter | 0.8 | 间接依赖 | pip |
| cryptography | 41.0.4 | 间接依赖 | pip |
| hvac | 0.7.2 | 间接依赖 | pip |
| api-ms-win-crt-string-l1-1-0.dll | 间接依赖 | ||
| arrow | 0.4.2 | 间接依赖 | pip |
| django-csp | 3.7 | 间接依赖 | pip |
| more-itertools | 9.0.0 | 间接依赖 | pip |
| pycparser | 2.21 | 间接依赖 | pip |
| httpagentparser | 1.9.0 | 间接依赖 | pip |
| MultiWidget | 间接依赖 | pip | |
| zato-vault-client | 1.3 | 间接依赖 | pip |
| httplib2 | 0.19.0 | 间接依赖 | pip |
| pyzmq | 25.0.2 | 间接依赖 | pip |
| fhirpy | 1.3.0 | 间接依赖 | pip |
| api-ms-win-crt-environment-l1-1-0.dll | 间接依赖 | ||
| netifaces | 0.11.0 | 间接依赖 | pip |
| zxcvbn | 4.4.28 | 间接依赖 | pip |
| zato-ext-paodate | 1.3 | 间接依赖 | pip |
| api-ms-win-crt-heap-l1-1-0.dll | 间接依赖 | ||
| keyring | 23.0.0 | 间接依赖 | pip |
| api-ms-win-core-path-l1-1-0.dll | 间接依赖 | ||
| api-ms-win-crt-convert-l1-1-0.dll | 间接依赖 | ||
| elasticsearch | 7.15.2 | 间接依赖 | pip |
| VCRUNTIME140.dll | 间接依赖 | ||
| ws4py | 0.3.5 | 间接依赖 | pip |
| hl7apy | 1.3.4 | 间接依赖 | pip |
| setproctitle | 1.3.2 | 间接依赖 | pip |
| api-ms-win-crt-conio-l1-1-0.dll | 间接依赖 | ||
| pg8000 | 1.13.1 | 间接依赖 | pip |
| pyotp | 2.6.0 | 间接依赖 | pip |
| Mako | 1.2.2 | 间接依赖 | pip |
| dictalchemy | 0.1.2.6 | 间接依赖 | pip |
| passlib | 1.7.1 | 间接依赖 | pip |
| python-editor | 1.0.1 | 间接依赖 | pip |
| simple-parsing | 0.0.17 | 间接依赖 | pip |
| orjson | 3.8.2 | 间接依赖 | pip |
| click | 1.1 | 间接依赖 | pip |
| chardet | 4.0.0 | 间接依赖 | pip |
| openpyxl | 3.0.5 | 间接依赖 | pip |
| sarge | 0.1.7.post1 | 间接依赖 | pip |
| portalocker | 2.6.0 | 间接依赖 | pip |
| google-auth-httplib2 | 0.1.0 | 间接依赖 | pip |
| mock | 3.0.5 | 间接依赖 | pip |
| USER32.dll | 间接依赖 | ||
| crontab | 0.22.9 | 间接依赖 | pip |
| texttable | 1.6.1 | 间接依赖 | pip |
| pyasn1 | 0.4.8 | 间接依赖 | pip |
| typing-extensions | 4.3.0 | 间接依赖 | pip |
| api-ms-win-crt-runtime-l1-1-0.dll | 间接依赖 | ||
| suds | 1.0.0 | 间接依赖 | pip |
| six | 1.16.0 | 间接依赖 | pip |