PyPI Lack of Version Pinning

Under certain circumstances (in application dependency descriptors) the versions should be pinned to avoid misbehaviour or injection of malicious dependencies (direct or indirect).

For example, under PyPI, a publishable Pipfile.lock makes dependencies pinned and avoids future injections, but existing vulnerabilities for the pinned versions should be handled.

This detector checks if the pinning file exists and is added to control version.

If the project has not version pinning files as:

or requirements.txt file with not all versions pinned (with == operator), then attackers can create new public malicious packages with higher version number, and the PyPI installer could use the new version.

If the attacker gains access to publish new versions of nice-package, he/she can create a new version "99.9.9" with malware, and pip will happily resolve this new malicious version.

Create a lock file to fix dependencies and sub-dependencies. Some tools like Poetry automatically generates poetry.lock from dependencies listed in pyproject.toml. It is recommended to keep the lock file under version control, so it is shared with team members, and when version updates are done on the dependencies manifest, the lock file could be regenerated.

Modern version management with pip follows the Repeatable Installs and Secure Installs approach, where package versions are pinned and hash-checking add integrity protection against remote tampering. The requirements file containing pinned package versions can be generated using pip freeze, which pins not only direct dependencies, but also all of their transitive dependencies.

If you are using poetry, you can generate a lockfile with pinned versions for direct and transitive dependencies with poetry lock --no-update (--no-update prevents updating dependencies).

Of course, reviewing dependencies is always recommended. But at least an attack based on introducing malware on new versions of existing packages will not affect you immediately.

Malware packages are detected by the community or by Xygeni Malware Early Warning, and known vulnerabilities are also detected and patched regularly. You have to trade off the rate of version updates for getting security and quality patches but without opening the door to supply-chain attacks.

Version pinning helps with reproducible builds, and forces version upgrades not to be fully automatic.

References: