starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

Insecure Randomness in generate_secret_key.py #874

New Issue
Closed
opened 2025-12-29 16:26:34 +01:00 by adam · 2 comments
adam commented 2025-12-29 16:26:34 +01:00
Owner
Copy Link

Originally created by @tam7t on GitHub (Apr 20, 2017).

Issue type: bug report

Python version:
NetBox version:

While the seed is cryptographically secure the random module uses the Mersenne Twister by default which is not secure.

Additionally, the way that random.seed works (by taking a hash of the provided value) results in a significantly smaller keyspace than intended.

Originally created by @tam7t on GitHub (Apr 20, 2017). <!-- Please note: GitHub issues are to be used only for feature requests and bug reports. For installation assistance or general discussion, please join us on the mailing list: https://groups.google.com/forum/#!forum/netbox-discuss Please indicate "bug report" or "feature request" below. Be sure to search the existing set of issues (both open and closed) to see if a similar issue has already been raised. --> ### Issue type: bug report <!-- If filing a bug, please indicate the version of Python and NetBox you are running. (This is not necessary for feature requests.) --> **Python version:** **NetBox version:** <!-- If filing a bug, please record the exact steps taken to reproduce the bug and any errors messages that are generated. If filing a feature request, please precisely describe the data model or workflow you would like to see implemented, and provide a use case. --> While the seed is cryptographically secure the random module uses the Mersenne Twister by default which is not secure. Additionally, the way that `random.seed` works (by taking a hash of the provided value) results in a significantly smaller keyspace than intended.
adam added the type: bug label 2025-12-29 16:26:34 +01:00
adam closed this issue 2025-12-29 16:26:34 +01:00
adam commented 2025-12-29 16:26:34 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Apr 21, 2017):

generate_secret_key.py is a convenience tool used to generate one-off random values for Django's SECRET_KEY configuration setting. If we were generating millions of keys per second, this might be a concern, but I see no reason to deviate from the current logic. (Additionally, the PR submitted against this would have reduced the key space by a factor of 12^50.)

@jeremystretch commented on GitHub (Apr 21, 2017): `generate_secret_key.py` is a convenience tool used to generate one-off random values for Django's [`SECRET_KEY`](https://docs.djangoproject.com/en/1.11/ref/settings/#secret-key) configuration setting. If we were generating millions of keys per second, this might be a concern, but I see no reason to deviate from the current logic. (Additionally, the PR submitted against this would have reduced the key space by a factor of 12^50.)
adam commented 2025-12-29 16:26:34 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (Apr 21, 2017):

Spoke with @tam7t some more and now I understand what he was saying. I still want to avoid using the base64 library though.

@jeremystretch commented on GitHub (Apr 21, 2017): Spoke with @tam7t some more and now I understand what he was saying. I still want to avoid using the base64 library though.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#874
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?