基础信息
项目名称：tensorflow/lingvo
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1755031030895816704/1755031031017451520
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| JupyterLab 安全漏洞 | XSS | MPS-0x8r-3lja | CVE-2024-22420 | 中危 |
| NumPy 代码问题漏洞 | 空指针取消引用 | MPS-2021-32278 | CVE-2021-41495 | 中危 |
| Google TensorFlow 目录穿越漏洞 | 路径遍历 | MPS-2021-9211 | CVE-2021-35958 | 严重 |
| mpmath 存在ReDoS漏洞 | ReDoS | MPS-2022-14993 | 中危 | |
| pyelftools 存在拒绝服务漏洞 | 拒绝服务 | MPS-2022-15067 | 低危 | |
| urllib3 安全漏洞 | MPS-46py-nxai | CVE-2023-45803 | 中危 | |
| OpenSSL 拒绝服务漏洞 | 对因果或异常条件的不恰当检查 | MPS-7ch0-so2p | CVE-2023-5678 | 中危 |
| Apache Arrow PyArrow 任意代码执行 | 反序列化 | MPS-eck2-x5ys | CVE-2023-47248 | 高危 |
| JupyterLab 安全漏洞 | 未授权敏感信息泄露 | MPS-f5zx-7pim | CVE-2024-22421 | 中危 |
| cryptography | 空指针取消引用 | MPS-gt9j-ch43 | CVE-2023-49083 | 中危 |
| fontTools 代码问题漏洞 | XXE | MPS-qz5k-x9jb | CVE-2023-45139 | 高危 |
| urllib3 HTTP重定向信息泄露漏洞 | 未授权敏感信息泄露 | MPS-s0oy-afbw | CVE-2023-43804 | 高危 |
| python-cryptography 安全漏洞 | 通过时间差异性导致的信息暴露 | MPS-tf9k-xu02 | CVE-2023-50782 | 中危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| cryptography | 41.0.3 | 间接依赖 | 建议修复 | |
| tensorflow | 2.13.0 | 间接依赖 | 建议修复 | |
| urllib3 | 1.26.16 | 1.26.18 | 间接依赖 | 建议修复 |
| pyarrow | 11.0.0 | 14.0.1 | 间接依赖 | 建议修复 |
| numpy | 1.24.3 | 间接依赖 | 可选修复 | |
| pyelftools | 0.29 | 间接依赖 | 可选修复 | |
| jupyterlab | 4.0.5 | 4.0.11 | 间接依赖 | 可选修复 |
| mpmath | 1.3.0 | 间接依赖 | 可选修复 | |
| fonttools | 4.42.1 | 4.43.0 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| Apache-2.0 | 33 | 低 |
| MIT License | 1 | 低 |
| BSD-3-Clause | 49 | 低 |
| Apache-2.0 OR MIT | 1 | 低 |
| BSD-2-Clause | 12 | 低 |
| 自定义许可证 | 20 | 低 |
| MIT | 52 | 低 |
| MPL-2.0 | 2 | 低 |
| ISC | 4 | 低 |
| Python-2.0 | 2 | 低 |
| GPL-3.0-or-later | 1 | 低 |
| HPND | 1 | 低 |
| 0BSD | 1 | 低 |
| Apache License 2.0 | 2 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| google-api-core | 2.11.1 | 间接依赖 | pip |
| google-pasta | 0.2.0 | 间接依赖 | pip |
| async-lru | 2.0.4 | 间接依赖 | pip |
| ipykernel | 6.25.1 | 间接依赖 | pip |
| cloudpickle | 2.2.1 | 间接依赖 | pip |
| jupyter_server_terminals | 0.4.4 | 间接依赖 | pip |
| sniffio | 1.3.0 | 间接依赖 | pip |
| terminado | 0.17.1 | 间接依赖 | pip |
| jsonpointer | 2.4 | 间接依赖 | pip |
| Sphinx | 7.2.2 | 间接依赖 | pip |
| imagesize | 1.4.1 | 间接依赖 | pip |
| traitlets | 5.9.0 | 间接依赖 | pip |
| jupyter_server | 2.7.2 | 间接依赖 | pip |
| h5py | 3.9.0 | 间接依赖 | pip |
| certifi | 2023.7.22 | 间接依赖 | pip |
| dnspython | 2.4.2 | 间接依赖 | pip |
| json5 | 0.9.14 | 间接依赖 | pip |
| argon2-cffi | 23.1.0 | 间接依赖 | pip |
| pyelftools | 0.29 | 间接依赖 | pip |
| attrs | 23.1.0 | 间接依赖 | pip |
| hdfs | 2.7.2 | 间接依赖 | pip |
| pycparser | 2.21 | 间接依赖 | pip |
| docutils | 0.18.1 | 间接依赖 | pip |
| alabaster | 0.7.13 | 间接依赖 | pip |
| backcall | 0.2.0 | 间接依赖 | pip |
| twine | 4.0.2 | 间接依赖 | pip |
| matplotlib | 3.7.2 | 间接依赖 | pip |
| tensorflow-datasets | 4.9.2 | 间接依赖 | pip |
| snowballstemmer | 2.2.0 | 间接依赖 | pip |
| nbconvert | 7.7.4 | 间接依赖 | pip |
| mpmath | 1.3.0 | 间接依赖 | pip |
| cycler | 0.11.0 | 间接依赖 | pip |
| fasteners | 0.18 | 间接依赖 | pip |
| webcolors | 1.13 | 间接依赖 | pip |
| decorator | 5.1.1 | 间接依赖 | pip |
| nest-asyncio | 1.5.7 | 间接依赖 | pip |
| requests-toolbelt | 1.0.0 | 间接依赖 | pip |
| sphinxcontrib-htmlhelp | 2.0.4 | 间接依赖 | pip |
| tensorflow-hub | 0.14.0 | 间接依赖 | pip |
| dm-tree | 0.1.8 | 间接依赖 | pip |
| tensorflow-probability | 0.21.0 | 间接依赖 | pip |
| jeepney | 0.8.0 | 间接依赖 | pip |
| sphinxcontrib-applehelp | 1.0.7 | 间接依赖 | pip |
| jupyter | 1.0.0 | 间接依赖 | pip |
| absl-py | 1.4.0 | 间接依赖 | pip |
| pytz | 2023.3 | 间接依赖 | pip |
| python-json-logger | 2.0.7 | 间接依赖 | pip |
| tensorflow-text | 2.13.0 | 间接依赖 | pip |
| PyYAML | 6.0.1 | 间接依赖 | pip |
| uritemplate | 4.1.1 | 间接依赖 | pip |
| six | 1.16.0 | 间接依赖 | pip |
| flatbuffers | 23.5.26 | 间接依赖 | pip |
| argon2-cffi-bindings | 21.2.0 | 间接依赖 | pip |
| apache-beam | 2.49.0 | 间接依赖 | pip |
| proto-plus | 1.22.3 | 间接依赖 | pip |
| typing_extensions | 4.5.0 | 间接依赖 | pip |
| sphinxcontrib-qthelp | 1.0.6 | 间接依赖 | pip |
| jedi | 0.19.0 | 间接依赖 | pip |
| charset-normalizer | 3.2.0 | 间接依赖 | pip |
| jupyterlab-widgets | 3.0.8 | 间接依赖 | pip |
| referencing | 0.30.2 | 间接依赖 | pip |
| readme-renderer | 41.0 | 间接依赖 | pip |
| contourpy | 1.1.0 | 间接依赖 | pip |
| pyzmq | 25.1.1 | 间接依赖 | pip |
| jupyter-lsp | 2.2.0 | 间接依赖 | pip |
| tomli | 2.0.1 | 间接依赖 | pip |
| Send2Trash | 1.8.2 | 间接依赖 | pip |
| urllib3 | 1.26.16 | 间接依赖 | pip |
| anyio | 3.7.1 | 间接依赖 | pip |
| defusedxml | 0.7.1 | 间接依赖 | pip |
| overrides | 7.4.0 | 间接依赖 | pip |
| fastavro | 1.8.2 | 间接依赖 | pip |
| fqdn | 1.5.1 | 间接依赖 | pip |
| dataclasses | 0.6 | 间接依赖 | pip |
| dill | 0.3.1.1 | 间接依赖 | pip |
| jupyter-events | 0.7.0 | 间接依赖 | pip |
| toml | 0.10.2 | 间接依赖 | pip |
| joblib | 1.3.2 | 间接依赖 | pip |
| cachetools | 5.3.1 | 间接依赖 | pip |
| importlib-resources | 6.0.1 | 间接依赖 | pip |
| graph-compression-google-research | 0.0.4 | 间接依赖 | pip |
| recommonmark | 0.7.1 | 间接依赖 | pip |
| jupyterlab-pygments | 0.2.2 | 间接依赖 | pip |
| promise | 2.3 | 间接依赖 | pip |
| python-dateutil | 2.8.2 | 间接依赖 | pip |
| patchelf | 0.17.2.1 | 间接依赖 | pip |
| webencodings | 0.5.1 | 间接依赖 | pip |
| crcmod | 1.7 | 间接依赖 | pip |
| rfc3339-validator | 0.1.4 | 间接依赖 | pip |
| tensorboard-data-server | 0.7.1 | 间接依赖 | pip |
| orjson | 3.9.5 | 间接依赖 | pip |
| Pillow | 10.0.0 | 间接依赖 | pip |
| numpy | 1.24.3 | 间接依赖 | pip |
| opt-einsum | 3.3.0 | 间接依赖 | pip |
| sphinxcontrib-serializinghtml | 1.1.9 | 间接依赖 | pip |
| freezegun | 1.2.2 | 间接依赖 | pip |
| fonttools | 4.42.1 | 间接依赖 | pip |
| SecretStorage | 3.3.3 | 间接依赖 | pip |
| parso | 0.8.3 | 间接依赖 | pip |
| auditwheel | 5.4.0 | 间接依赖 | pip |
| google-auth-httplib2 | 0.1.0 | 间接依赖 | pip |
| exceptiongroup | 1.1.3 | 间接依赖 | pip |
| scikit-learn | 1.3.0 | 间接依赖 | pip |
| requests | 2.31.0 | 间接依赖 | pip |
| zstandard | 0.21.0 | 间接依赖 | pip |
| model-pruning-google-research | 0.0.5 | 间接依赖 | pip |
| astunparse | 1.6.3 | 间接依赖 | pip |
| sympy | 1.12 | 间接依赖 | pip |
| prometheus-client | 0.17.1 | 间接依赖 | pip |
| oauth2client | 4.1.3 | 间接依赖 | pip |
| google-auth-oauthlib | 1.0.0 | 间接依赖 | pip |
| termcolor | 2.3.0 | 间接依赖 | pip |
| click | 8.1.7 | 间接依赖 | pip |
| pyparsing | 3.0.9 | 间接依赖 | pip |
| Pygments | 2.16.1 | 间接依赖 | pip |
| Markdown | 3.4.4 | 间接依赖 | pip |
| pexpect | 4.8.0 | 间接依赖 | pip |
| debugpy | 1.6.7.post1 | 间接依赖 | pip |
| contextlib2 | 21.6.0 | 间接依赖 | pip |
| rfc3986 | 2.0.0 | 间接依赖 | pip |
| pickleshare | 0.7.5 | 间接依赖 | pip |
| /docker/dev.requirements.txt | 间接依赖 | pip | |
| sphinx-rtd-theme | 1.3.0 | 间接依赖 | pip |
| platformdirs | 3.10.0 | 间接依赖 | pip |
| more-itertools | 10.1.0 | 间接依赖 | pip |
| tensorflow | 2.13.0 | 间接依赖 | pip |
| jaraco.classes | 3.3.0 | 间接依赖 | pip |
| tensorflow-io-gcs-filesystem | 0.33.0 | 间接依赖 | pip |
| notebook | 7.0.2 | 间接依赖 | pip |
| ipywidgets | 8.1.0 | 间接依赖 | pip |
| ipython-genutils | 0.2.0 | 间接依赖 | pip |
| jupyter-http-over-ws | 0.0.8 | 间接依赖 | pip |
| uri-template | 1.3.0 | 间接依赖 | pip |
| matplotlib-inline | 0.1.6 | 间接依赖 | pip |
| protobuf | 3.20.3 | 间接依赖 | pip |
| comm | 0.1.4 | 间接依赖 | pip |
| jupyter-console | 6.6.3 | 间接依赖 | pip |
| sentencepiece | 0.1.99 | 间接依赖 | pip |
| Jinja2 | 3.1.2 | 间接依赖 | pip |
| jupyter_core | 5.3.1 | 间接依赖 | pip |
| sphinxcontrib-devhelp | 1.0.5 | 间接依赖 | pip |
| pymongo | 4.4.1 | 间接依赖 | pip |
| cffi | 1.15.1 | 间接依赖 | pip |
| google-api-python-client | 2.97.0 | 间接依赖 | pip |
| scipy | 1.11.2 | 间接依赖 | pip |
| tensorboard | 2.13.0 | 间接依赖 | pip |
| prompt-toolkit | 3.0.39 | 间接依赖 | pip |
| mock | 5.1.0 | 间接依赖 | pip |
| sphinxcontrib-jquery | 4.1 | 间接依赖 | pip |
| MarkupSafe | 2.1.3 | 间接依赖 | pip |
| nbclient | 0.8.0 | 间接依赖 | pip |
| rich | 13.5.2 | 间接依赖 | pip |
| sphinxcontrib-jsmath | 1.0.1 | 间接依赖 | pip |
| requests-oauthlib | 1.3.1 | 间接依赖 | pip |
| bleach | 6.0.0 | 间接依赖 | pip |
| arrow | 1.2.3 | 间接依赖 | pip |
| websocket-client | 1.6.1 | 间接依赖 | pip |
| pkginfo | 1.9.6 | 间接依赖 | pip |
| mdurl | 0.1.2 | 间接依赖 | pip |
| tensorflow-estimator | 2.13.0 | 间接依赖 | pip |
| stack-data | 0.6.2 | 间接依赖 | pip |
| kiwisolver | 1.4.4 | 间接依赖 | pip |
| Werkzeug | 2.3.7 | 间接依赖 | pip |
| markdown-it-py | 3.0.0 | 间接依赖 | pip |
| array-record | 0.4.1 | 间接依赖 | pip |
| googleapis-common-protos | 1.60.0 | 间接依赖 | pip |
| isoduration | 20.11.0 | 间接依赖 | pip |
| tensorflow-metadata | 1.14.0 | 间接依赖 | pip |
| pandocfilters | 1.5.0 | 间接依赖 | pip |
| pyasn1-modules | 0.3.0 | 间接依赖 | pip |
| Babel | 2.12.1 | 间接依赖 | pip |
| packaging | 23.1 | 间接依赖 | pip |
| pydot | 1.4.2 | 间接依赖 | pip |
| rsa | 4.9 | 间接依赖 | pip |
| qtconsole | 5.4.3 | 间接依赖 | pip |
| threadpoolctl | 3.2.0 | 间接依赖 | pip |
| psutil | 5.9.5 | 间接依赖 | pip |
| pyarrow | 11.0.0 | 间接依赖 | pip |
| ipython | 8.14.0 | 间接依赖 | pip |
| wcwidth | 0.2.6 | 间接依赖 | pip |
| mistune | 3.0.1 | 间接依赖 | pip |
| ptyprocess | 0.7.0 | 间接依赖 | pip |
| fastjsonschema | 2.18.0 | 间接依赖 | pip |
| docopt | 0.6.2 | 间接依赖 | pip |
| oauthlib | 3.2.2 | 间接依赖 | pip |
| widgetsnbextension | 4.0.8 | 间接依赖 | pip |
| soupsieve | 2.4.1 | 间接依赖 | pip |
| objsize | 0.6.1 | 间接依赖 | pip |
| jupyterlab | 4.0.5 | 间接依赖 | pip |
| tqdm | 4.66.1 | 间接依赖 | pip |
| pyasn1 | 0.5.0 | 间接依赖 | pip |
| tornado | 6.3.3 | 间接依赖 | pip |
| rfc3986-validator | 0.1.1 | 间接依赖 | pip |
| jupyter_client | 8.3.0 | 间接依赖 | pip |
| libclang | 16.0.6 | 间接依赖 | pip |
| google-auth | 2.22.0 | 间接依赖 | pip |
| etils | 1.4.1 | 间接依赖 | pip |
| executing | 1.2.0 | 间接依赖 | pip |
| nbformat | 5.9.2 | 间接依赖 | pip |
| jsonschema-specifications | 2023.7.1 | 间接依赖 | pip |
| jupyterlab_server | 2.24.0 | 间接依赖 | pip |
| beautifulsoup4 | 4.12.2 | 间接依赖 | pip |
| grpcio | 1.57.0 | 间接依赖 | pip |
| httplib2 | 0.22.0 | 间接依赖 | pip |
| notebook_shim | 0.2.3 | 间接依赖 | pip |
| backports.lzma | 0.0.14 | 间接依赖 | pip |
| commonmark | 0.9.1 | 间接依赖 | pip |
| keras | 2.13.1 | 间接依赖 | pip |
| importlib-metadata | 6.8.0 | 间接依赖 | pip |
| pandas | 2.0.3 | 间接依赖 | pip |
| gast | 0.4.0 | 间接依赖 | pip |
| cryptography | 41.0.3 | 间接依赖 | pip |
| zipp | 3.16.2 | 间接依赖 | pip |
| QtPy | 2.3.1 | 间接依赖 | pip |
| jsonschema | 4.19.0 | 间接依赖 | pip |
| pure-eval | 0.2.2 | 间接依赖 | pip |
| wrapt | 1.15.0 | 间接依赖 | pip |
| idna | 3.4 | 间接依赖 | pip |
| tzdata | 2023.3 | 间接依赖 | pip |
| tinycss2 | 1.2.1 | 间接依赖 | pip |
| keyring | 24.2.0 | 间接依赖 | pip |
| regex | 2023.8.8 | 间接依赖 | pip |
| rpds-py | 0.9.2 | 间接依赖 | pip |
| asttokens | 2.2.1 | 间接依赖 | pip |