基础信息
项目名称：postgresml/postgresml
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1732608381124304896/1732608381946388480
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| aiohttp 注入漏洞 | CRLF注入 | MPS-1pnm-9ket | CVE-2023-49082 | 中危 |
| NumPy 代码问题漏洞 | 空指针取消引用 | MPS-2021-32278 | CVE-2021-41495 | 中危 |
| loguru 代码注入漏洞 | 代码注入 | MPS-2022-1393 | CVE-2022-0329 | 严重 |
| LangChain 安全漏洞 | SSRF | MPS-3lbr-e46h | CVE-2023-46229 | 高危 |
| urllib3 安全漏洞 | MPS-46py-nxai | CVE-2023-45803 | 中危 | |
| AIOHTTP | HTTP请求走私 | MPS-5tgd-mv7y | CVE-2023-47627 | 中危 |
| aiohttp 安全漏洞 | MPS-6yia-uo9n | CVE-2023-49081 | 中危 | |
| LangChain 代码注入漏洞 | 代码注入 | MPS-7jdv-a49n | CVE-2023-36281 | 严重 |
| Langchain 安全漏洞 | 注入 | MPS-a49n-xm37 | CVE-2023-32786 | 高危 |
| Apache Arrow PyArrow 任意代码执行 | 反序列化 | MPS-eck2-x5ys | CVE-2023-47248 | 高危 |
| urllib3 HTTP重定向信息泄露漏洞 | 未授权敏感信息泄露 | MPS-s0oy-afbw | CVE-2023-43804 | 高危 |
| LangChain 安全漏洞 | MPS-slg6-50up | CVE-2023-44467 | 严重 | |
| langchain注入漏洞 | 注入 | MPS-x9qb-uct8 | CVE-2023-39659 | 严重 |
| LangChain 安全漏洞 | 代码注入 | MPS-ze2c-1nou | CVE-2023-39631 | 严重 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| pyarrow | 13.0.0 | 14.0.1 | 间接依赖 | 建议修复 |
| pyarrow | 11.0.0 | 14.0.1 | 间接依赖 | 建议修复 |
| pyarrow | 12.0.1 | 14.0.1 | 间接依赖 | 建议修复 |
| urllib3 | 2.0.4 | 2.0.7 | 间接依赖 | 建议修复 |
| langchain | 0.0.287 | 0.0.329 | 间接依赖 | 建议修复 |
| loguru | 0.7.0 | 间接依赖 | 建议修复 | |
| aiohttp | 3.8.5 | 3.9.0 | 间接依赖 | 建议修复 |
| numpy | 1.25.2 | 间接依赖 | 可选修复 | |
| charset-normalizer | 3.2.0 | 间接依赖 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| Apache-2.0 | 18 | 低 |
| BSD-3-Clause | 7 | 低 |
| 自定义许可证 | 23 | 低 |
| MIT | 21 | 低 |
| ISC | 2 | 低 |
| BSD-2-Clause | 1 | 低 |
| Unlicense | 2 | 低 |
| Apache-2.0 OR MIT | 1 | 低 |
| MPL-2.0 | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| InstructorEmbedding | 1.0.1 | 间接依赖 | pip |
| click | 8.1.6 | 间接依赖 | pip |
| lightgbm | 4.1.0 | 间接依赖 | pip |
| multidict | 6.0.4 | 间接依赖 | pip |
| attrs | 23.1.0 | 间接依赖 | pip |
| langchain | 0.0.287 | 间接依赖 | pip |
| dnspython | 2.4.2 | 间接依赖 | pip |
| charset-normalizer | 3.2.0 | 间接依赖 | pip |
| markdown-it-py | 3.0.0 | 间接依赖 | pip |
| Pygments | 2.16.1 | 间接依赖 | pip |
| yarl | 1.9.2 | 间接依赖 | pip |
| ctransformers | 0.2.27 | 间接依赖 | pip |
| platformdirs | 3.10.0 | 间接依赖 | pip |
| async-timeout | 4.0.3 | 间接依赖 | pip |
| dompurify | 3.0.6 | 间接依赖 | npm |
| Model | 间接依赖 | pip | |
| loguru | 0.7.0 | 间接依赖 | pip |
| idna | 3.4 | 间接依赖 | pip |
| dill | 0.3.7 | 间接依赖 | pip |
| python-dateutil | 2.8.2 | 间接依赖 | pip |
| tomli | 2.0.1 | 间接依赖 | pip |
| sentencepiece | 0.1.99 | 间接依赖 | pip |
| marked | 9.1.0 | 间接依赖 | npm |
| pandas | 2.1.0 | 间接依赖 | pip |
| peft | 0.6.2 | 间接依赖 | pip |
| Dict | 间接依赖 | pip | |
| tokenizers | 0.14.1 | 间接依赖 | pip |
| torchvision | 0.15.2 | 间接依赖 | pip |
| sentence-transformers | 2.2.2 | 间接依赖 | pip |
| sacrebleu | 2.3.1 | 间接依赖 | pip |
| packaging | 23.1 | 间接依赖 | pip |
| autosize | 6.0.1 | 间接依赖 | npm |
| transformers | 4.34.1 | 间接依赖 | pip |
| urllib3 | 2.0.4 | 间接依赖 | pip |
| optimum | 1.13.2 | 间接依赖 | pip |
| huggingface-hub | 0.16.4 | 间接依赖 | pip |
| psycopg | 3.1.10 | 间接依赖 | pip |
| accelerate | 0.22.0 | 间接依赖 | pip |
| Collection | 间接依赖 | pip | |
| torchaudio | 2.0.2 | 间接依赖 | pip |
| mdurl | 0.1.2 | 间接依赖 | pip |
| scikit-learn | 1.3.0 | 间接依赖 | pip |
| filelock | 3.12.2 | 间接依赖 | pip |
| multiprocess | 0.70.15 | 间接依赖 | pip |
| transformers-stream-generator | 0.0.4 | 间接依赖 | pip |
| PyYAML | 6.0.1 | 间接依赖 | pip |
| pyarrow | 13.0.0 | 间接依赖 | pip |
| xgboost | 1.6.2 | 间接依赖 | pip |
| orjson | 3.9.7 | 间接依赖 | pip |
| typing_extensions | 4.7.1 | 间接依赖 | pip |
| frozenlist | 1.4.0 | 间接依赖 | pip |
| aiohttp | 3.8.5 | 间接依赖 | pip |
| auto-gptq | 0.4.2 | 间接依赖 | pip |
| mypy-extensions | 1.0.0 | 间接依赖 | pip |
| aiosignal | 1.3.1 | 间接依赖 | pip |
| fsspec | 2023.6.0 | 间接依赖 | pip |
| certifi | 2023.7.22 | 间接依赖 | pip |
| xxhash | 3.3.0 | 间接依赖 | pip |
| tqdm | 4.66.1 | 间接依赖 | pip |
| tzdata | 2023.3 | 间接依赖 | pip |
| requests | 2.31.0 | 间接依赖 | pip |
| psycopg-pool | 3.1.7 | 间接依赖 | pip |
| black | 23.7.0 | 间接依赖 | pip |
| einops | 0.6.1 | 间接依赖 | pip |
| pyarrow | 12.0.1 | 间接依赖 | pip |
| bitsandbytes | 0.41.1 | 间接依赖 | pip |
| rich | 13.5.2 | 间接依赖 | pip |
| pgml | 0.9.0 | 间接依赖 | pip |
| deepspeed | 0.10.3 | 间接依赖 | pip |
| sacremoses | 0.0.53 | 间接依赖 | pip |
| torch | 2.0.1 | 间接依赖 | pip |
| pynvml | 11.5.0 | 间接依赖 | pip |
| pytz | 2023.3 | 间接依赖 | pip |
| pyarrow | 11.0.0 | 间接依赖 | pip |
| List | 间接依赖 | pip | |
| rouge | 1.0.1 | 间接依赖 | pip |
| huggingface-hub | 0.17.1 | 间接依赖 | pip |
| catboost | 1.2 | 间接依赖 | pip |
| xformers | 0.0.21 | 间接依赖 | pip |
| pgml | 间接依赖 | pip | |
| six | 1.16.0 | 间接依赖 | pip |
| filelock | 3.12.3 | 间接依赖 | pip |
| pgml | 0.8.1 | 间接依赖 | pip |
| datasets | 2.14.5 | 间接依赖 | pip |
| python-dotenv | 1.0.0 | 间接依赖 | pip |
| pinecone-client | 2.2.2 | 间接依赖 | pip |
| numpy | 1.25.2 | 间接依赖 | pip |
| datasets | 2.14.4 | 间接依赖 | pip |
| pandas | 2.0.3 | 间接依赖 | pip |
| pathspec | 0.11.2 | 间接依赖 | pip |
| pgml | 间接依赖 | npm |