Hey y all just sharing some pretty crazy stuff I had to deal

Question

Hey y all just sharing some pretty crazy stuff I had to deal with today here at work They got `pex` flagged as a security threat and I spent the whole day defending and explaining what it is the usage Here at the company IT is using Nexus IQ Scanner and it found these vulnerabilities `pex 2 1 21 tar gz ` threat level 9 lvl 9 lvl 7 lvl 7 lvl 6 lvl 6 and for `pex py2 py3 none any 2 1 21 whl ` lvl 7 lvl 7 So threats lvl 9+ are immediatly put into quarantine and we developers can t use those packages

wooden-thailand-8386 · Answer

Afaik from my `pip install` and ` pants version` bootstrap it seem like it always tries to get the ` whl` package from my internal pypi but for whatever reason they were very worried about that `tar gz` with those lvl 9

wooden-thailand-8386 · Answer

So I discovered what that ` tar gz` is it s the actual `pex` source code from github

jolly-midnight-72759 · Answer

If that `tar gz` came from an internal repository would that remediate the vulnerability

wooden-thailand-8386 · Answer

That tar gz was the pex repository from pypi

happy-kitchen-89482 · Answer

Do I understand correctly that this is actually a problem with pip

happy-kitchen-89482 · Answer

Are your IT people suggesting that you cannot use standalone pip either

wooden-thailand-8386 · Answer

< happy kitchen 89482> you re correct It was one of the most insane discussions I ve had in my professional life lol