Preventing issues when installing Python

Bravura Security Fabric has a requirement for the interpreter our code uses for scripted automation and some integrations for a specific Python version series, which was available when the specific version was developed; however, the Python project does not provide binaries for their latest security releases, only code.

This article addresses that requirement, its installation settings, and our mitigation for the Python project's lack of security releases in binary form.

When the Python project releases code for security fixes (CVEs), they are usually for obscure features and use cases which Bravura Security Fabric is not using,; however customer auditors have to check their checklists and make sure the production environments are as secure as possible.

Reason for requirement

Each new version series of Python introduces syntax changes, and updating a growing body of code to a new interpreter generation takes months of dedicated work, which is why you cannot use a newer Python release series in an older Bravura Security Fabric instance. Unless you restrict security releases to the Python version required by each specific version of Bravura Security Fabric, you risk functionality failures in the product.

This is also relevant during in-place upgrades.

Before running the installer to a new version of Bravura Security Fabric , when the product services are down, the Python interpreter version required for the new instance must be installed, and the old version must be removed to prevent accidental use of it in the new version.

On servers where different versions of Bravura Security Fabric have to run, the Python path in the environment variables available for each instance's service accounts and the instance's instance.bat have to be manually adjusted (the installer doesn't handle that use case.)

Solution

Upgrade to the latest released version of Bravura Security Fabric with its relevant Python version.

If a security audit suggests a Python upgrade to a different version than the one documented to work with your Bravura Security Fabric version, do not follow that advice as it will break product functionality. Instead,it is recommended to compile the Python security release relevant to the product version.

To install correctly:

An alternative to running the installer manually and checking the right boxes in the msiexec GUI is to automate the installation from an elevated command prompt like this:

python-3.5.3-amd64.exe /quiet InstallAllUsers=1 AssociateFiles=1 PrependPath=1 Include_test=0

If using the GUI:

Mitigation

If you cannot upgrade the instance yet and have to use a Bravura Security Fabric version that uses an older Python version: