Attributed metadata history

v1.3.0

Fixed Security Issues Code Execution by Custom Template Variables A security issue was identified in the template vars feature, where usage of untrusted processing pipelines can lead to unintended code execution by usage of the template vars feature. While the code execution of the vars feature is intentional, users of the pySigma library and developers using the library in their projects might not be aware that processing pipelines can imply execution of arbitrary code. Exploitation of the issue requires usage of pipelines that were created with malicious intent. Common scenarios are: Usage of publicly shared processing pipelines without verification. Web applications where processing pipelines are provided by untrusted users. CI/CD compromise: a pull request or imported artifact introduces a crafted processing pipeline, leading to command execution during automated rule conversion. The issue was mitigated by: The template vars feature must be explicitly activated with the allow_template_vars parameter on the ProcessingPipeline, ProcessingItem, QueryPostprocessingItem or one of the templating transformations. Alternatively, the feature can be enabled by the PYSIGMA_ALLOW_VARS_EXECUTION environment variable. It is not possible to enable this feature from the pipeline itself! By default, the referenced vars files containing the Python code must be located in the directory that contains the pipeline file. Additional base paths can be specified by the vars_allowed_paths of the classes mentioned above. At the time of the release, no exploitation of this vulnerability is known. Thanks to Luân Trần Quang (X profile) for responsible disclosure of the issue. Jinja2 Template Injection The usage of specially crafted Jinja2 templates can lead to unintended code execution by usage of unrestricted rendering environment. The exploitation vectors are similar to the aforementioned vulnerability above. It was fixed by usage of a sandboxed environment provided by Jinja2, that prevents the usage of problematic features. At the time of the release, no exploitation of this vulnerability is known. This vulnerability was identified by own research conducted by Thomas Patzke (pySigma maintainer). What's Changed Extend replace_string transformation to handle numeric values by @Copilot in #445 Ensure file is closed by @FlorianBracq in #446 Updated readthedocs build environment by @thomaspatzke in #447 Update typing from conversion module by @FlorianBracq in #448 Implement pairwise TODO in converstion/base.py by @FlorianBracq in #449 Add test coverage for uncovered error paths and edge cases by @Copilot in #450 Modernize type hints and dispatchers for Python 3.10+ by @Copilot in #451 Perf: cache condition parsing, type hints, and optimize string operations by @Copilot in #452 Deprecate ExceptionOnUsage by @FlorianBracq in #453 Add security measures for vars execution in TemplateBase by @thomaspatzke in #455 Replace Jinja2 Environment with SandboxedEnvironment for enhanced security in TemplateBase by @thomaspatzke in #456 Updated dependencies by @thomaspatzke in #457 Full Changelog: v1.2.0...v1.3.0

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.