Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

gen_secret_key.py uses system (urandom) PRNG #4813

Closed
byteborg opened this issue Nov 16, 2023 · 0 comments · Fixed by #4814
Closed

gen_secret_key.py uses system (urandom) PRNG #4813

byteborg opened this issue Nov 16, 2023 · 0 comments · Fixed by #4814
Labels
type: bug Something isn't working as expected

Comments

@byteborg
Copy link
Contributor

Environment

  • Nautobot version (Docker tag too if applicable): develop
  • Python version: 3.9.6
  • Database platform, version: n/a
  • Middleware(s): n/a

Steps to Reproduce

  1. gen_secret_key.py uses "random" instead of "secrets" module

Expected Behavior

gen_secret_key.py outputs a unique 50 char secret

Observed Behavior

gen_secret_key.py uses random.SystemRandom() which does not guarantee randomness for cryptohraphic tokens and secrets
@byteborg byteborg added triage This issue is new and has not been reviewed. type: bug Something isn't working as expected labels Nov 16, 2023
@byteborg byteborg mentioned this issue Nov 16, 2023
Merged
@glennmatthews glennmatthews removed the triage This issue is new and has not been reviewed. label Nov 20, 2023
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Mar 5, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
type: bug Something isn't working as expected
Projects
No open projects
Nautobot Core ⚙️
Status: Done
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Use secrets modules for key generation byteborg/nautobot
2 participants
@byteborg @glennmatthews