Spectra Assure

warningRisk: Hardening

Scanned:

qiskit-aer

Artifact:

latest

Top 10k

Aer - High performance simulators for Qiskit

License: Permissive (Apache-2.0)

Published:

Visit GitHub

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

1 baseline mitigations missing

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

List of software quality issues with the number of affected components.

Policies

Info

Problem

Data Execution Prevention (DEP/NX) is a vulnerability mitigation option that prevents data from being interpreted as code anywhere within the application. This mitigation protects the application stack, heap and other memory data ranges. Executable files that fail to implement this mitigation expose the user to increased risks of malicious code injection.

Prevalence in PyPI community

23 packages

found in

Top 100

96 packages

found in

Top 1k

422 packages

found in

Top 10k

5.91k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language linker documentation.

In Microsoft VisualStudio, you can enable DEP mitigation by setting the linker option /NXCOMPAT to ON.

Problem

Sensitive executable memory regions should be kept as read-only to protect the integrity of trusted execution code flow paths. Imported function addresses are pointers to the symbols that implement the application-required functionality. If those pointers are changed by malicious code, execution paths can be redirected to unintended locations. Most modern programming language toolchains protect those memory regions appropriately. These issues are commonly reported for outdated linkers and non-compliant executable packing solutions.

Prevalence in PyPI community

15 packages

found in

Top 100

29 packages

found in

Top 1k

165 packages

found in

Top 10k

3.83k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Sensitive executable memory regions should be kept as read-only to protect the integrity of trusted execution code flow paths. Thread local storage (TLS) callbacks are pointers to code initialization and resource release functions. If those pointers are changed by malicious code, execution paths can be redirected to unintended locations. Most modern programming language toolchains protect those memory regions appropriately. These issues are commonly reported for outdated linkers and non-compliant executable packing solutions.

Prevalence in PyPI community

7 packages

found in

Top 100

16 packages

found in

Top 1k

121 packages

found in

Top 10k

3.03k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Address Space Layout Randomization (ASLR) is a vulnerability mitigation option that forces software components to load on a different memory base address each time they are used. This makes the memory layout unpredictable, and it is therefore harder for malicious code to be reliably injected during application runtime. Although enabling ASLR is an opt-in setting during program linking, some operating system configurations can still enforce its use if the vulnerability mitigation requirements are met. This is possible even if the application hasn't been explicitly marked as ASLR-compatible. While this generally improves security posture, the limitation of ASLR enforcement is that the application load addresses are not truly randomized. In most cases, the application load base is different than the default, but it remains the same for the entire duration of device uptime.

Prevalence in PyPI community

19 packages

found in

Top 100

71 packages

found in

Top 1k

285 packages

found in

Top 10k

3.05k packages

in community

Next steps

In Microsoft VisualStudio, you should explicitly enable ASLR mitigation by setting the linker option /DYNAMICBASE to ON.

Problem

Prevalence in PyPI community

29 packages

found in

Top 100

114 packages

found in

Top 1k

525 packages

found in

Top 10k

8.89k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that dynamic calls are made only to vetted functions. Trusted execution paths rely on the ability of the operating system to build a list of valid function targets. Certain functions can intentionally be disallowed to prevent malicious code from deactivating vulnerability mitigation features. A list of such invalid function targets can include publicly exported symbols. Applications that enhance control flow integrity through export suppression rely on libraries to mark their publicly visible symbols as suppressed. This is done for all symbols that are considered to be sensitive functions, and to which access should be restricted. It is considered dangerous to mix applications that perform export suppression with libraries that do not.

Prevalence in PyPI community

30 packages

found in

Top 100

143 packages

found in

Top 1k

833 packages

found in

Top 10k

15.19k packages

in community

Next steps

To enable this mitigation on library code, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Control Flow Guard (CFG/CFI) protects the code flow integrity by ensuring that indirect calls are made only to vetted functions. This mitigation protects dynamically resolved function targets by instrumenting the code responsible for transferring execution control. Higher-level programming languages implement structured exception handling by managing their own code flow execution paths. As such, they are subject to code flow hijacking during runtime. Language-specific exception handling mitigation enforces execution integrity by instrumenting calls to manage execution context switching. Any deviation from the known and trusted code flow paths will cause the application to terminate. This makes malicious code less likely to execute.

Prevalence in PyPI community

36 packages

found in

Top 100

164 packages

found in

Top 1k

932 packages

found in

Top 10k

17.86k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PyPI community

23 packages

found in

Top 100

96 packages

found in

Top 1k

422 packages

found in

Top 10k

5.91k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language linker documentation.

In Microsoft VisualStudio, you can enable DEP mitigation by setting the linker option /NXCOMPAT to ON.

Problem

Prevalence in PyPI community

15 packages

found in

Top 100

29 packages

found in

Top 1k

165 packages

found in

Top 10k

3.83k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Prevalence in PyPI community

7 packages

found in

Top 100

16 packages

found in

Top 1k

121 packages

found in

Top 10k

3.03k packages

in community

Next steps

Review the programming language linker options, and consider a build toolchain update.

Problem

Prevalence in PyPI community

19 packages

found in

Top 100

71 packages

found in

Top 1k

285 packages

found in

Top 10k

3.05k packages

in community

Next steps

In Microsoft VisualStudio, you should explicitly enable ASLR mitigation by setting the linker option /DYNAMICBASE to ON.

Problem

Prevalence in PyPI community

29 packages

found in

Top 100

114 packages

found in

Top 1k

525 packages

found in

Top 10k

8.89k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in PyPI community

30 packages

found in

Top 100

143 packages

found in

Top 1k

833 packages

found in

Top 10k

15.19k packages

in community

Next steps

To enable this mitigation on library code, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

Problem

Prevalence in PyPI community

36 packages

found in

Top 100

164 packages

found in

Top 1k

932 packages

found in

Top 10k

17.86k packages

in community

Next steps

It's highly recommended to enable this option for all software components used at security boundaries, or those that process user controlled inputs.

To enable this mitigation, refer to your programming language toolchain documentation.

In Microsoft VisualStudio, you can enable CFG mitigation by passing the /guard:cf parameter to the compiler and linker.

qiskit-aer

SAFE Assessment

Compliance

Security

Threats

SQ14102Detected Windows executable files that do not implement the DEP vulnerability mitigation protection.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

SQ14156Detected Windows executable files with imported functions susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ14158Detected Windows executable files with TLS callbacks susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ14108Detected Windows executable files that rely on the ineffective ASLR vulnerability mitigation enforcement option.Causes risk: reduced effectiveness mitigationshardening

Problem

Prevalence in PyPI community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

SQ14125Detected Windows shared library files that do not suppress exports which reduces CFG vulnerability mitigation protection effectiveness.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

SQ14127Detected Windows executable files that do not implement long jump control flow vulnerability mitigation protection.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

Did you know...

SQ14102Detected Windows executable files that do not implement the DEP vulnerability mitigation protection.Causes risk: baseline mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

SQ14156Detected Windows executable files with imported functions susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ14158Detected Windows executable files with TLS callbacks susceptible to pointer hijacking.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ14108Detected Windows executable files that rely on the ineffective ASLR vulnerability mitigation enforcement option.Causes risk: reduced effectiveness mitigationshardening

Problem

Prevalence in PyPI community

Next steps

SQ14122Detected Windows executable files that do not implement CFG vulnerability mitigation protection.Causes risk: modern mitigations missinghardening

Problem

Prevalence in PyPI community

Next steps

SQ14125Detected Windows shared library files that do not suppress exports which reduces CFG vulnerability mitigation protection effectiveness.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps

SQ14127Detected Windows executable files that do not implement long jump control flow vulnerability mitigation protection.Causes risk: low priority mitigations absenthardening

Problem

Prevalence in PyPI community

Next steps