Repository: cloud-custodian/cloud-custodian

Issue:
c7n mailer dependency has a high vulnerability
### Describe the bug

c7n mailer depends on starkbank-ecdsa==1.1.1

This library at this version has been found to have a high vulnerability.

https://github.com/advisories/GHSA-9wx7-jrvc-28mm

The version has been fixed in version 2.0.1


### What did you expect to happen?

No vulnerabilities found in dependency libraries

### Cloud Provider

Amazon Web Services (AWS)

### Cloud Custodian version and dependency information

```shell
Custodian:   0.9.13
Python:      3.9.7 (default, Sep  1 2021, 14:45:30)
             [GCC 10.3.1 20210424]
Platform:    posix.uname_result(sysname='Linux', nodename='b82f5787903f', release='5.11.0-1016-aws', version='#17~20.04.1-Ubuntu SMP Thu Aug 12 05:39:36 UTC 2021', machine='x86_64')
Using venv:  False
Docker: True
Installed:

argcomplete==1.12.3
attrs==21.2.0
boto3==1.17.102
botocore==1.20.102
importlib-metadata==4.6.0
jmespath==0.10.0
jsonschema==3.2.0
pyrsistent==0.18.0
python-dateutil==2.8.1
pyyaml==5.4.1
s3transfer==0.4.2
setuptools==57.4.0
six==1.16.0
tabulate==0.8.9
typing-extensions==3.10.0.0
urllib3==1.26.6
zipp==3.4.1
```


### Policy

_No response_

### Relevant log/traceback output

```shell
Trivy output:


Python (python-pkg)
===================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)
+-----------------+---------------------+----------+-------------------+---------------+----------------------------------------------+
|     LIBRARY     |  VULNERABILITY ID   | SEVERITY | INSTALLED VERSION | FIXED VERSION |                    TITLE                     |
+-----------------+---------------------+----------+-------------------+---------------+----------------------------------------------+
| starkbank-ecdsa | GHSA-9wx7-jrvc-28mm | HIGH     | 1.1.1             | 2.0.1         | Signature verification vulnerability         |
|                 |                     |          |                   |               | in Stark Bank ecdsa libraries                |
|                 |                     |          |                   |               | -->github.com/advisories/GHSA-9wx7-jrvc-28mm |
+-----------------+---------------------+----------+-------------------+---------------+----------------------------------------------+
```
```


### Extra information or context

_No response_


Discussion:
Thanks for the report @isuftin - this looks like it has just been addressed upstream in the sendgrid library ( https://github.com/sendgrid/sendgrid-python/pull/1022 ). I suspect we'll need to keep an eye on that and bump our sendgrid version here when a new release drops.
we are still waiting on a release of the upstream sendgrid library, as it is currently published with a starbank-ecsda pin < 2
per comment from upstream, next release on sendgrid library is scheduled for 11/17/2021 per https://github.com/sendgrid/sendgrid-python/issues/1023

also to be clear this isn't a direct dependency of custodian, its a transitive dep graph dependency.

i'm a bit torn if we should wait that long for a new release, as we're due ourselves. I'd think i'd prefer we just go ahead and do a release, and then do a smaller patch release for the dep upgrade. alternatively we could publish the release with a manual exception to our normal release process. our normal process is to freeze the entire dependency graph to ensure repeatable installs of a version, for this we could optionally unfreeze sendgrid so we auto pick up their release. most of the nag scanners though will harp on the minimum version afaicr :/



Looks like a CVE was minted to join up with the GHSA advisory ;) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43572

Resolving patch:
diff --git a/tools/dev/poetrypkg.py b/tools/dev/poetrypkg.py
--- a/tools/dev/poetrypkg.py
+++ b/tools/dev/poetrypkg.py
@@ -123,7 +123,9 @@ def convert_dependencies(cls, package, dependencies):
 @cli.command()
 @click.option('-p', '--package-dir', type=click.Path())
 @click.option('-o', '--output', default='setup.py')
-def gen_frozensetup(package_dir, output):
+@click.option('-x', '--exclude', multiple=True)
+@click.option('-r', '--remove', multiple=True)
+def gen_frozensetup(package_dir, output, exclude, remove):
     """Generate a frozen setup suitable for distribution.
     """
     from poetry.core.masonry.builders import sdist
@@ -138,7 +140,7 @@ class FrozenBuilder(sdist.SdistBuilder):
 
         @classmethod
         def convert_dependencies(cls, package, dependencies):
-            reqs, default = locked_deps(package, poetry)
+            reqs, default = locked_deps(package, poetry, exclude, remove)
             resolve_source_deps(poetry, package, reqs, frozen=True)
             return reqs, default
 
@@ -184,10 +186,18 @@ def resolve_source_deps(poetry, package, reqs, frozen=False):
             seen.add(cdep)
 
 
-def locked_deps(package, poetry):
+def locked_deps(package, poetry, exclude=(), remove=()):
     reqs = []
     packages = poetry.locker.locked_repository(False).packages
+
+    project_deps = {
+        r.name: r for r in poetry.package.requires}
     for p in packages:
+        if p.name in exclude:
+            reqs.append(project_deps[p.name].to_pep_508())
+            continue
+        if p.name in remove:
+            continue
         dep = p.to_dependency()
         line = "{}=={}".format(p.name, p.version)
         requirement = dep.to_pep_508()


Test patch:
diff --git a/tests/test_iam.py b/tests/test_iam.py
--- a/tests/test_iam.py
+++ b/tests/test_iam.py
@@ -87,7 +87,7 @@ def test_credential_access_key_multifilter_delete(self):
                 {"type": "credential",
                  "report_max_age": 1543724277,
                  "key": "access_keys.last_rotated",
-                 "value": 700,
+                 "value": 900,
                  "op": "greater-than",
                  'value_type': 'age'}],
             'actions': [