[Snyk] Security upgrade cryptography from 41.0.3 to 41.0.4

[madchap]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `pip` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • requirements.txt

⚠️ Warning

celery 5.3.0 requires kombu, which is not installed.

Vulnerabilities that will be fixed

By pinning:

Severity	Priority Score (*)	Issue	Upgrade	Breaking Change	Exploit Maturity
	611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Denial of Service (DoS) SNYK-PYTHON-CRYPTOGRAPHY-5914629	cryptography: 41.0.3 -> 41.0.4	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Some vulnerabilities couldn't be fully fixed and so Snyk will still find them when the project is tested again. This may be because the vulnerability existed within more than one direct dependency, but not all of the affected dependencies could be upgraded.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)

[secureflag-knowledge-base]

Lack of Resources and Rate Limiting

Play Labs on this vulnerability with SecureFlag!

Description

Whilst the internet may often seem as though it were boundless, it is still bound by a finite amount of computing resources and subject to limitations, with only so much bandwidth, CPU processing power, memory allocation, and storage to go around. At the individual level, for example, think of the last time you tried to spin up that third virtual machine while the host browser was feverishly feeding your multiple open tab habit... resource limitations in action! And although this illustration depicts a non-malicious - indeed, self-imposed - consequence of overload for an individual laptop, there are, unfortunately, attacks that leverage resource and rate limitations of web applications and APIs that have not been configured correctly.

Application requests are pretty much what make the internet the internet, with some estimates suggesting that API requests alone make up over 83% of all web traffic. Applications perform day-to-day functions adequately when the request parameters governing the numbers of processes, size of payloads, etc., are set at the appropriate minimums and maximums. However, when the aforementioned resources are incorrectly assigned, applications are not only subject to poor or non-existent performance, but they can also be commandeered by malicious actors to disrupt and deny service.

According to OWASP's API4:2019 Lack of Resources & Rate Limiting post, APIs, for example, are vulnerable if even just one of the below limits is lacking or incorrectly set:

• Execution timeouts: the API gateway will wait a certain number of seconds for the endpoint to return a response... this value can be anywhere from 1 second to many years' worth of seconds, so it is important to define correctly.
• Max allocable memory: the maximum amount of memory allocated to the API.
• Number of file descriptors: the more files opened for your process, the more labor-intensive.
• Number of processes: the more processes, the more labor-intensive.
• Request payload size (e.g., uploads): the larger the upload, the greater the consumption.
• Number of requests per client/resource: this could be 100 requests per 100 seconds per user but also 1000 requests per 100 seconds per user - 10X the load.
• Number of records per page to return in a single request-response: stuffing more records into a single response will naturally degrade performance.

Bottom line: set one of the above too low or too high, and your application is at risk.

Read more

Impact

Whatever the type of application, inadequately configured resource allocation, and rate limits are routinely targeted by attackers. Attacks such as these undermine reliability and availability of entire ecosystems, inevitably resulting in financial and reputational loss.

Scenarios

Suppose an API is tasked with the retrieval of user-profiles and their corresponding details, providing, as most APIs do, access to its resources that take the form of lists of entities. A set limit of returnable items would typically confine a client filtering this list.

www.vulnerableapp.com/api/v1/get_user_list?page=1&size=9000000

An astute observer will have noticed that the request here would return page 1 and the first 9000000 users, which certainly seems like an above-average number of users for just one page! This attack would succeed to overwhelm the API if the size parameter was improperly validated.

Prevention

Attacks targeting application misconfigurations that allow unbridled resources and limits are common - the exploitation is uncomplicated and requires minimal resources to execute. Fortunately, robust defense is reasonably straightforward to implement so long as attention is paid to limits that dictate finite resources, i.e., the abovementioned CPU processing power, memory allocation, number of processes and file descriptors, etc.

Prevention strategies include:

• Limiting the number of times a client can call an application within a given timeframe.
• Setting limit numbers and reset times and communicating them with the client.
• Ensuring query strings and request body parameters are properly validated by the server.
• Place a limit on the data size of incoming parameters and payloads.
• For any application, adhere to best practices laid out in the configuration guidelines. For example, APIs moored in the overwhelmingly popular Docker need only review and adequately implement appropriate configurations for memory resources, CPU, restart policies, and container ulimits (limits for file descriptors and processes).

Testing

Verify that anti-automation controls are effective at mitigating breached credential testing, brute force, and account lockout attacks. Such controls include blocking the most common breached passwords, soft lockouts, rate limiting, CAPTCHA, ever-increasing delays between attempts, IP address restrictions, or risk-based restrictions such as location, first login on a device, recent attempts to unlock the account, or similar.

• OWASP ASVS: 2.2.1
• OWASP Testing Guide: Testing for Weak Lock Out Mechanism

References

Akamai - State of Internet Security

OWASP - API-Security

CloudVector - OWASP API Security

View this in the SecureFlag Knowledge Base