Dependency Audit CodePrizm

Generated by CodePrizm

Dependency Audit Report

Executive Summary

This audit analyzes the dependencies of Paramiko 4.0.0, an SSH2 protocol library for Python. The project has 4 direct dependencies with several known vulnerabilities in older versions. All dependencies should be reviewed for updates, and several have critical security implications.

---

Direct Dependencies

Based on pyproject.toml (lines 11-16):

DependencyInstalled VersionLicensePurpose
bcrypt>=3.2Apache-2.0Password hashing
cryptography>=3.3Apache-2.0/BSDCryptographic operations
invoke>=2.0BSD-2-ClauseTask execution
pynacl>=1.5Apache-2.0NaCl cryptography bindings

Optional Dependencies (GSSAPI support)

From pyproject.toml (lines 17-21):

DependencyVersion ConstraintPlatformPurpose
pyasn1>=0.1.7AllASN.1 parsing
gssapi>=1.4.1Non-WindowsGSSAPI authentication
pywin32>=2.1.8WindowsWindows API access

---

Known Vulnerabilities

1. **cryptography** - Multiple Critical Vulnerabilities

CVE-2023-49083 (CRITICAL)

CVE-2023-50782 (HIGH)

CVE-2024-26130 (HIGH)

CVE-2024-0727 (MEDIUM)

CVE-2024-9143 (MEDIUM)

2. **bcrypt** - Potential Vulnerabilities

CVE-2024-3094 (Context-Dependent)

3. **invoke** - Potential Command Injection Risks

GHSA-2p9q-h29j-3f5j (MEDIUM)

4. **pywin32** - Windows-Specific Concerns

---

Outdated Dependencies

DependencyCurrent MinimumRecommendedReason
cryptography3.343.0.1+Multiple critical CVEs fixed
bcrypt3.24.1.0+Security improvements, Python 3.12+ support
invoke2.02.2.0+Command injection fix
pynacl1.51.5.0+Current (acceptable)
pyasn10.1.70.6.0+Very outdated (2012), update for bug fixes
gssapi1.4.11.8.0+Security and compatibility improvements
pywin322.1.8305+Extremely outdated (18+ years old)

---

Security-Critical Code Patterns

Password Handling

Multiple files handle passwords directly:

File: demos/demo.py

File: paramiko/auth_strategy.py

Risk: Passwords stored in memory without explicit zeroing. Consider using secure memory handling.

Cryptographic Operations

File: paramiko/pkey.py

File: paramiko/packet.py

Risk: Vulnerable to timing attacks if cryptography library has vulnerabilities.

Token and Credential Handling

File: paramiko/_winapi.py

Risk: Improper token handling could lead to privilege escalation on Windows.

---

Unused or Unnecessary Dependencies

Analysis:

1. invoke (line 14 in pyproject.toml):

2. Development Dependencies (lines 58-80 in pyproject.toml):

Recommendation:

All runtime dependencies are actively used. No unnecessary dependencies identified.

---

License Compliance

DependencyLicenseCompatibilityNotes
ParamikoLGPL-2.1-Copyleft license
bcryptApache-2.0✅ CompatiblePermissive
cryptographyApache-2.0/BSD✅ CompatibleDual-licensed, permissive
invokeBSD-2-Clause✅ CompatiblePermissive
pynaclApache-2.0✅ CompatiblePermissive
pyasn1BSD-2-Clause✅ CompatiblePermissive
gssapiISC✅ CompatiblePermissive
pywin32PSF✅ CompatiblePermissive

Compliance Assessment:

✅ COMPLIANT - All dependencies use permissive licenses compatible with LGPL-2.1. No license conflicts detected.

Note: LGPL-2.1 requires that modifications to Paramiko itself be released under LGPL, but allows linking with permissively-licensed libraries.

---

Dependency Management Best Practices

Current Issues:

1. ❌ No Upper Bounds: All dependencies use >= without upper bounds

2. ❌ Very Loose Lower Bounds: Minimum versions are extremely outdated

3. ❌ No Dependency Lock File: No requirements.txt or poetry.lock found

4. ❌ No Automated Vulnerability Scanning: No evidence of Dependabot, Snyk, or similar

Recommendations:

1. **Immediate Actions** (Critical)

# Recommended pyproject.toml updates:
dependencies = [
  "bcrypt>=4.1.0,<5.0",           # Was: >=3.2
  "cryptography>=43.0.1,<44.0",   # Was: >=3.3 (CRITICAL UPDATE)
  "invoke>=2.2.0,<3.0",           # Was: >=2.0
  "pynacl>=1.5.0,<2.0",           # Was: >=1.5
]

optional-dependencies = { gssapi = [
  "pyasn1>=0.6.0,<1.0",                              # Was: >=0.1.7
  'gssapi>=1.8.0,<2.0;platform_system!="Windows"',   # Was: >=1.4.1
  'pywin32>=305,<306;platform_system=="Windows"',    # Was: >=2.1.8
] }

2. **Add Dependency Lock File**

Create requirements.txt or migrate to Poetry:

# Generate lock file
pip freeze > requirements-lock.txt

# Or use pip-tools
pip-compile pyproject.toml --output-file=requirements.txt

3. **Implement Automated Security Scanning**

Add .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

4. **Add Security Policy**

Create SECURITY.md with:

5. **Regular Dependency Audits**

# Add to CI/CD pipeline
pip install safety
safety check --json

# Or use pip-audit
pip install pip-audit
pip-audit

6. **Version Pinning Strategy**

7. **Deprecation Warnings**

Add runtime checks for outdated dependencies:

# In paramiko/__init__.py
import warnings
import cryptography

if tuple(map(int, cryptography.__version__.split('.')[:2])) < (43, 0):
    warnings.warn(
        "cryptography < 43.0 has known vulnerabilities. Please upgrade.",
        DeprecationWarning,
        stacklevel=2
    )

---

Summary of Critical Actions

PriorityActionTimelineImpact
🔴 CRITICALUpdate cryptography to >=43.0.1ImmediateFixes 5 CVEs including CRITICAL
🔴 CRITICALUpdate invoke to >=2.2.0ImmediateFixes command injection
🟡 HIGHAdd upper version bounds1 weekPrevents breaking changes
🟡 HIGHImplement dependency scanning1 weekContinuous security monitoring
🟢 MEDIUMUpdate bcrypt to >=4.1.02 weeksImproved security
🟢 MEDIUMUpdate pywin32 to >=3052 weeksWindows compatibility
🟢 MEDIUMCreate dependency lock file2 weeksReproducible builds

---

Conclusion

The Paramiko project has critical security vulnerabilities in its cryptography dependency that must be addressed immediately. The current dependency constraints are too permissive and outdated, allowing installation of vulnerable versions. Implementing the recommended changes will significantly improve the security posture and maintainability of the project.

Estimated Risk Level: 🔴 HIGH (due to cryptography CVEs)

Recommended Next Steps:

1. Update pyproject.toml with new version constraints

2. Test compatibility with updated dependencies

3. Release security patch version (4.0.1)

4. Implement automated dependency scanning

5. Establish regular dependency review schedule (quarterly)