Heya is it meant to not remove the old vulnerable entry when

Question

Heya is it meant to not remove the old vulnerable entry when I update

Tomas Touceda · Answer

could it be that both versions are still available

Mystery Incorporated · Answer

Not at all just v3 4 8 is installed which is not even showing in that list at all but when I list python packaes it is there I will show you the list of python packages Also it is doing it with httplib2

Mystery Incorporated · Answer

Here is output of installed packages from pip I updated to 3 3 and then 3 4 8 those days ago and still it doesn t say 3 4 8 is installed and lists the two vulnerable versions that are not

Mystery Incorporated · Answer

At least it shows the current version of httplib2 as well

Mystery Incorporated · Answer

This is the dir that the packages get installed to

Mystery Incorporated · Answer

On a completely different host it sees the 3 4 8 version but still lists the non existant 2 8 vulnerable version

Tomas Touceda · Answer

gotcha could you please file a bug report <https github com fleetdm fleet issues new assignees= amp labels=bug 2C 3Areproduce amp template=bug report md amp title=> I ll look into it

Tomas Touceda · Answer

could you tell me what the result of this osquery query is ```SELECT name AS name version AS version Package Python AS type python packages AS source FROM python packages```

Mystery Incorporated · Answer

I ll check now

Mystery Incorporated · Answer

< Tomas Touceda> the output of that command shows only the old no longer installed version of the python package

Tomas Touceda · Answer

ah you uninstalled that version and only have the newer one that s odd wonder why osquery is returning that still

Mystery Incorporated · Answer

On a second host it doesn t show even the old httplib2 it shows none at all And still shows the old cryptography 2 8

Mystery Incorporated · Answer

And it is definitely installed pip list

Tomas Touceda · Answer

might be something interesting to ask in < C08V7KTJB|general>