starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Upgrade dependencies with security releases #2069

New Issue
Closed
opened 2025-12-29 17:22:00 +01:00 by adam · 1 comment
adam commented 2025-12-29 17:22:00 +01:00
Owner
Copy Link

Originally created by @volans- on GitHub (Oct 18, 2018).

GitHub is reporting that 2 of the fixed version dependencies of Netbox have security upgrades and both are marked as high severity by GitHub.

  • Paramiko (CVE-2018-1000805)
    Vulnerable versions: >= 2.4.0, < 2.4.2
    Patched version: 2.4.2

  • pycryptodome (CVE-2018-15560)
    Vulnerable versions: < 3.6.6
    Patched version: 3.6.6

In both cases the requirements.txt file is forcing the exact version and doesn't allow for an easier upgrade.
Take into consideration also the possibility to relax a bit those requirements to allow for patch version upgrades at least.

Originally created by @volans- on GitHub (Oct 18, 2018). GitHub is reporting that 2 of the fixed version dependencies of Netbox have security upgrades and both are marked as _high severity_ by GitHub. - Paramiko (CVE-2018-1000805) Vulnerable versions: >= 2.4.0, < 2.4.2 Patched version: 2.4.2 - pycryptodome (CVE-2018-15560) Vulnerable versions: < 3.6.6 Patched version: 3.6.6 In both cases the `requirements.txt` file is forcing the exact version and doesn't allow for an easier upgrade. Take into consideration also the possibility to relax a bit those requirements to allow for patch version upgrades at least.
adam added the type: bugstatus: accepted labels 2025-12-29 17:22:00 +01:00
adam closed this issue 2025-12-29 17:22:00 +01:00
adam commented 2025-12-29 17:22:01 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Oct 22, 2018):

Thank you for the heads up!

@jeremystretch commented on GitHub (Oct 22, 2018): Thank you for the heads up!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#2069
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?