starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

requirements.txt security issues. #4612

New Issue
Closed
opened 2025-12-29 18:38:16 +01:00 by adam · 10 comments
adam commented 2025-12-29 18:38:16 +01:00
Owner
Copy Link

Originally created by @synnack on GitHub (Mar 2, 2021).

The requirements.txt pins full and insecure versions.

Suggested fix:
Stop pinning minor versions. It is bad practice. Make sure people deploy with pip's 'safety check' and update requirements independently of netbox.

Alternative fix:
Bump version for django: 3.1.7
Bump version for pyyaml: 5.4.1
Bump version for jinja2: 2.11.3

Originally created by @synnack on GitHub (Mar 2, 2021). The requirements.txt pins full and insecure versions. Suggested fix: Stop pinning minor versions. It is bad practice. Make sure people deploy with pip's 'safety check' and update requirements independently of netbox. Alternative fix: Bump version for django: 3.1.7 Bump version for pyyaml: 5.4.1 Bump version for jinja2: 2.11.3
adam added the status: revisions needed label 2025-12-29 18:38:16 +01:00
adam closed this issue 2025-12-29 18:38:16 +01:00
adam commented 2025-12-29 18:38:17 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Mar 2, 2021):

We pin specific versions for good reason: Leaving them open to unplanned upgrades often breaks compatibility. You can find many example of this problem here and on the project's mailing list. (Edit: See #4198)

I'm happy to update these specific packages in the next release, but to be clear we will continue pinning dependencies to specific versions to ensure NetBox works as expected.

@jeremystretch commented on GitHub (Mar 2, 2021): We pin specific versions for good reason: Leaving them open to unplanned upgrades often breaks compatibility. You can find many example of this problem here and on the project's mailing list. (Edit: See #4198) I'm happy to update these specific packages in the next release, but to be clear we will continue pinning dependencies to specific versions to ensure NetBox works as expected.
adam commented 2025-12-29 18:38:17 +01:00
Author
Owner
Copy Link

@synnack commented on GitHub (Mar 2, 2021):

It is still rather bad practice, if a library breaks something in a minor release, it is a bug in the library. Operationally, you should always install security updates in library minor version (and we do, of course, regardless of this requirements file).

@synnack commented on GitHub (Mar 2, 2021): It is still rather bad practice, if a library breaks something in a minor release, it is a bug in the library. Operationally, you should always install security updates in library minor version (and we do, of course, regardless of this requirements file).
adam commented 2025-12-29 18:38:17 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Mar 2, 2021):

if a library breaks something in a minor release, it is a bug in the library

Yes, I understand that. But most people who use NetBox do not, and they open bugs here.

and we do, of course, regardless of this requirements file

Everyone else has this option as well. No one is being forced to use these specific versions.

@jeremystretch commented on GitHub (Mar 2, 2021): > if a library breaks something in a minor release, it is a bug in the library Yes, I understand that. But most people who use NetBox do not, and they open bugs here. > and we do, of course, regardless of this requirements file Everyone else has this option as well. No one is being forced to use these specific versions.
adam commented 2025-12-29 18:38:17 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Mar 2, 2021):

Just going to leave this here... #4198

@DanSheps commented on GitHub (Mar 2, 2021): Just going to leave this here... #4198
adam commented 2025-12-29 18:38:17 +01:00
Author
Owner
Copy Link

@synnack commented on GitHub (Mar 2, 2021):

Yeah, that was a terrible idea.

@synnack commented on GitHub (Mar 2, 2021): Yeah, that was a terrible idea.
adam commented 2025-12-29 18:38:18 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Mar 2, 2021):

Also, please use the template for opening an issue

@DanSheps commented on GitHub (Mar 2, 2021): Also, please use the template for opening an issue
adam commented 2025-12-29 18:38:18 +01:00
Author
Owner
Copy Link

@job commented on GitHub (Mar 2, 2021):

If a library breaks in a minor update, it seems it wasn't minor and some investigation is warranted. The library upgrade will need to happen anyway at some point in time, so one might as well get it out of the way immediately.

@job commented on GitHub (Mar 2, 2021): If a library breaks in a minor update, it seems it wasn't minor and some investigation is warranted. The library upgrade will need to happen anyway at some point in time, so one might as well get it out of the way immediately.
adam commented 2025-12-29 18:38:18 +01:00
Author
Owner
Copy Link

@synnack commented on GitHub (Mar 3, 2021):

Well, I'm not going to use the template because I'm not a bureaucrat and there is nothing to reproduce and no expected behaviour, but I can add that the following vulnerabilities are in the dependency chain and just maybe perhaps this should be fixed for those that have actually deployed netbox in broken virtualenvs now:

pyyaml:
"A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. See CVE-2020-14343.",

jinja2:
"This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9.-]+.[a-zA-Z0-9.-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory. See CVE-2020-28493.",

django:
"In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments. See CVE-2021-3281.",

@synnack commented on GitHub (Mar 3, 2021): Well, I'm not going to use the template because I'm not a bureaucrat and there is nothing to reproduce and no expected behaviour, but I can add that the following vulnerabilities are in the dependency chain and just maybe perhaps this should be fixed for those that have actually deployed netbox in broken virtualenvs now: pyyaml: "A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. See CVE-2020-14343.", jinja2: "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory. See CVE-2020-28493.", django: "In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template" and "startproject --template") allows directory traversal via an archive with absolute paths or relative paths with dot segments. See CVE-2021-3281.",
adam commented 2025-12-29 18:38:19 +01:00
Author
Owner
Copy Link

@synnack commented on GitHub (Mar 3, 2021):

Or.. of course, do not advise people to use virtualenvs and explicit pip versions so that the responsibility is not with netbox (explicit pinning means the responsibility is on the netbox project and virtualenvs are subversive for operator update management).

In other words: You set explicit versions, you create a virtualenv, you become solely responsible for dependency security management.

Of course in my deployment I patched all that subversive virtualenv crap out for just this reason. So I can monitor the dependency chain.

@synnack commented on GitHub (Mar 3, 2021): Or.. of course, do not advise people to use virtualenvs and explicit pip versions so that the responsibility is not with netbox (explicit pinning means the responsibility is on the netbox project and virtualenvs are subversive for operator update management). In other words: You set explicit versions, you create a virtualenv, you become solely responsible for dependency security management. Of course in my deployment I patched all that subversive virtualenv crap out for just this reason. So I can monitor the dependency chain.
adam commented 2025-12-29 18:38:19 +01:00
Author
Owner
Copy Link

@DanSheps commented on GitHub (Mar 4, 2021):

Well, I'm not going to use the template because I'm not a bureaucrat and there is nothing to reproduce and no expected behaviour, but I can add that the following vulnerabilities are in the dependency chain and just maybe perhaps this should be fixed for those that have actually deployed netbox in broken virtualenvs now

Well, I guess I will just close this then

@DanSheps commented on GitHub (Mar 4, 2021): > Well, I'm not going to use the template because I'm not a bureaucrat and there is nothing to reproduce and no expected behaviour, but I can add that the following vulnerabilities are in the dependency chain and just maybe perhaps this should be fixed for those that have actually deployed netbox in broken virtualenvs now Well, I guess I will just close this then
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label status: revisions needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#4612
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?