A self-contained Python driver for communicating with MySQL servers, using an API that is compliant with the Python Database API Specification v2.0 (PEP 249).
List of software quality issues with the number of affected components.
category ALL
Policies
Info
Category
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as high severity.
Prevalence in PyPI community
42 packages
found in
Top 100
278 packages
found in
Top 1k
1960 packages
found in
Top 10k
77.08k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
If the update can't resolve the issue, create a plan to isolate or replace the affected component.
Problem
Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Copyleft licenses in particular impose substantial restrictions on the licensee. They typically require that any derived works, and even software code that merely interacts with copyleft code, be licensed under the same license. Since copyleft licenses are commonly applied to open source code, their inclusion requires that the entire software package becomes open sourced. For commercial applications, this is typically undesirable. Therefore, the inclusion of copyleft code is commonly avoided or even prohibited by the organization policy.
Prevalence in PyPI community
4 packages
found in
Top 100
42 packages
found in
Top 1k
659 packages
found in
Top 10k
89.98k packages
in community
Next steps
Confirm that the software package includes a copyleft component.
Investigate if the software publisher provides this component under a non-copyleft license.
Consider replacing the software component with an alternative that offers a license compatible with commercial use.
Problem
Software license is a legal instrument that governs the use and distribution of software source code and its binary representation. Software publishers have the freedom to choose any commonly used or purposefully written license to publish their work under. While some licenses are liberal and allow almost any kind of distribution, with or without code modification, other licenses are more restrictive and impose rules for their inclusion in other software projects. Some software licenses place restrictions on software distribution of the code they apply to. These restrictions may extend to the services built upon the code licensed under such restrictive licenses. Some restrictive licenses explicitly state that the licensee may not provide the software to third parties as a hosted or managed service, where the service provides users with access to any substantial set of the features or functionality of the licensed software. When building commercial applications, this is typically undesirable. Therefore, the inclusion of any code that may impose limits on software distribution is commonly avoided or even prohibited by the organization policy.
Prevalence in PyPI community
7 packages
found in
Top 100
82 packages
found in
Top 1k
1208 packages
found in
Top 10k
109.57k packages
in community
Next steps
Confirm that the software package references a component or a dependency with a restrictive license.
Consider replacing the software component with an alternative that offers a license compatible with organization policy.
Problem
Software composition analysis has identified a component with one or more known vulnerabilities. Based on the CVSS scoring, these vulnerabilities have been marked as low severity.
Prevalence in PyPI community
19 packages
found in
Top 100
59 packages
found in
Top 1k
395 packages
found in
Top 10k
11.9k packages
in community
Next steps
Perform impact analysis for the reported CVEs.
Update the component to the latest version.
Lower severity vulnerabilities can be resolved with less urgency, but you should still make a plan to do so.
Problem
Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.
Prevalence in PyPI community
16 packages
found in
Top 100
113 packages
found in
Top 1k
669 packages
found in
Top 10k
19.67k packages
in community
Next steps
Investigate reported detections as indicators of software tampering.
Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.