I'm writing program for commercial use and the company vulnerability scan gave me this.
Clicking on the links leads me to here https://nvd.nist.gov/vuln/detail/CVE-2018-15560. Now I'm sure I've never explicitly used any of these packages, I don't even know what they do.
I ran pip show pycrypto, pip show pycryptodome inside the docker container running the program, but got this:
root@ism-core-es-deployment-dev-6d94bc549-959bt:/app# python3 -m pip show pycryptodome
WARNING: Package(s) not found: pycryptodome
root@ism-core-es-deployment-dev-6d94bc549-959bt:/app# pip show pycrypto
WARNING: Package(s) not found: pycrypto
And they're not importable in python for me to dig more information. So my question is: how do you find which library/which part of my code is running this? I only know pycrypto-2.6.1.tar.gz is the package in question.