VB005: No vulnerability from documented behavior¶

A vulnerability report can be safely dismissed if the behavior is documented to occur, particularly when the documentation explicitly describes the security implications of the behavior or specific contexts in which the software is unsafe to use.

Examples¶

• Python's http.server is explicitly documented as not suitable for production use, as it only implements basic security checks.

• Python's pickle is explicitly documented as not secure, full stop.

Nuances¶

A downstream usage that violates the documented guidelines for use may be considered vulnerable.

For example: a report against pickle itself (for e.g. enabling code execution) may be safely dismissed, but a report against a downstream usage of pickle that ignores the documented warnings may be considered valid.

Credit¶

Suggested by Hugo van Kemenade.