Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use natlas' libnmap instead of the unmaintained libnmap #318

Merged
merged 2 commits into from
Jul 1, 2020

Conversation

0xdade
Copy link
Member

@0xdade 0xdade commented Jun 29, 2020

Drafting to start to show it works, but we shouldn't merge this until natlas/python-libnmap gets detached to a standalone repository. Once we do that, I'll change the repo name and setup deployment to pypi so that we can pip install it like normal, probably under the name natlas-libnmap.

When this lands it will close #299

@codeclimate
Copy link

codeclimate bot commented Jun 29, 2020

Code Climate has analyzed commit 705443c and detected 0 issues on this pull request.

View more on Code Climate.

@0xdade 0xdade marked this pull request as ready for review June 29, 2020 16:59
@0xdade 0xdade requested a review from ajacques June 29, 2020 16:59
@0xdade
Copy link
Member Author

0xdade commented Jun 30, 2020

@ajacques Hey look the underlying library has tests and even has an explicit test for the payload that resulted in the CVE

https://github.com/natlas/natlas-libnmap/blob/master/libnmap/test/test_new_parser.py#L7-L16

The library isn't setup in CI yet, but that shouldn't freeze this PR imo.

@0xdade 0xdade added server affecting natlas-server agent affecting natlas-agent security For security related findings dependencies Relating to project dependencies labels Jul 1, 2020
"sha256": "e278b91636323422e2ed88595982159b19bf80a9ad87826d8153f9b7b6af431a"
"sha256": "b0e09cd3f29a45974b789b5971a552ed52a68a27b104785fd1c6d02391bf4c2f"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do so many hashes change when we install one new package?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The top hash is a hash of all the packages installed, I think. Then more hashes are changing because versions are getting bumped automatically per the rules in Pipfile which mostly say either "*" which matches any version, or ~=x.x which matches any compatible version. We could make this happen less often by restricting to specific versions in Pipfile, though I don't think there's any particular value in that.

@0xdade 0xdade merged commit b0c695d into natlas:main Jul 1, 2020
@0xdade 0xdade deleted the defused_libnmap branch July 1, 2020 02:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
agent affecting natlas-agent dependencies Relating to project dependencies security For security related findings server affecting natlas-server
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Python-libnmap Vulnerability
2 participants