Upgrade configobj library to > 5.0.8

[Rebits]

Description

Regarding /~https://github.com/wazuh/wazuh-jenkins/issues/5724#issuecomment-1771170116, due to a vulnerability detected in configobj library prior to 1.11.0, it needs to be updated to a version later than 5.0.8, while checking its compatibility with other libraries required.

In addition it would be necessary to document which tests or modules make use of this dependency

[Deblintrake09]

Research update

• Currently this library is not being directly used in the repository. It is only added to the requirements file but never imported for usage, so technically it can be removed.

• Version 5.0.8 does not fix the related CVE-2023-26112 - https://nvd.nist.gov/vuln/detail/CVE-2023-26112
  • Proposed fix has not been merged: Address CVE-2023-26112 ReDoS DiffSK/configobj#236
  • Latest branch still presents offending line /~https://github.com/DiffSK/configobj/blob/e2ba4457c4651fa54f8d59d8dcdd3da950e956b8/src/configobj/validate.py#L533-L534

[Rebits]

@Deblintrake09 it seems this dependencies was included for the deprecated WPK integration tests

• [WPK] Remote Upgrading automatic test #855

The current tests no longer rely on that particular dependency. Therefore, I recommend removing the associated library from the system.

[Deblintrake09]

@Rebits Checking on this wazuh-jenkins it shows that it is not being used there either, so it is not a dependency for a Jenkins pipeline. It should be possible to remove it without affecting the repository.