Command Line Tools bundled Python 3.9.6 flagged by vulnerability scanner

This is a known problem with those scanning tools. A copy of Python sitting on the disk isn't an exploit risk.

Apple does sometimes update the bundled scripting tools included with Xcode, but there's no guarantee that an updated version will pass your security scans. In fact, the opposite is more likely true.

Any official Apple guidance

You’re unlikely to get official guidance here on the forums, where our primary focus is helping developers with code-level questions, not with their security audits.

I have also filed this through Feedback Assistant: FB23893693

That’s a good path for this.

Finally, I want to stress that scripting language runtimes built in to macOS have been deprecated since macOS 10.15. The runtime you’re referring too is used internally by our developers tools and appropriate for other use cases.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Just submitted FB23940030 to definitively fix this problem.

There is no reason that Apple should still be dependent on an old version of Python. Whatever Apple is using Python for could be done using Swift scripting instead.

Furthermore, using Swift would allow sysadmins direct access to the appropriate Apple APIs without resorting to fragile, cryptic solutions based on sed/awk/grep/etc.

Just submitted FB23940030

Fair enough. But just to set expectations here, LLDB is one of Apple’s core developer tools and Python is a core component of LLDB [1]. Breaking that dependency would be… tricky.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

[1] https://lldb.llvm.org/use/python-reference.html

Fair enough. But just to set expectations here, LLDB is one of Apple’s core developer tools and Python is a core component of LLDB [1]. Breaking that dependency would be… tricky.

Don't worry. No expectations are at risk. 😄

I wasn't aware that Python is tied into LLDB. That would complicate matters. It looks like there is a flag to build LLDB without Python.

I have a big project (GDAL) that includes components with similarly deep levels of integration with Python. Removing Python takes some work, but the results are always great. Taking Python out of a project makes so many problems just evaporate into thin air.

But even if you can't remove python from LLDB, I'm still not sure that LLDB requires a standalone python interpreter. Couldn't it simply be embedded for real?

Couldn't it simply be embedded for real?

I believe it is:

% vmmap lldb | grep Python | head -n 1
… /Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.9/Python3

However:

• It’s not clear whether simply removing the Python executable would be enough to satisfy Catalin_e10’s security audit.
• It’s likely that Python is used by other parts of the developer tools. I was using LLDB as an example, not as a complete list of all such dependencies.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

It’s not clear whether simply removing the Python executable would be enough to satisfy Catalin_e10’s security audit.

If the Python executable didn't exist, then there wouldn't be anything to audit.

It’s likely that Python is used by other parts of the developer tools.

That was my original assumption. In theory, this is also possible if Apple switched to the ancient bash or Perl. Since Python is a popular tool, it's more likely to be updated upstream and show up as vulnerable on macOS.

Swift scripting would solve those issues as it would probably never be part of a security audit and Apple's version would likely always be updated.

But it's a moot point as my feedback has already been closed. The reply said that "Feedback Assistant is only to submit bug reports and request enhancements to APIs and tools" and my enhancement request for Xcode was rejected.

The Apple reply also explicitly told me not to submit this kind of feedback again.