GHSA-qf3c-rw9f-jh7v

Suggest an improvement
Source
https://github.com/advisories/GHSA-qf3c-rw9f-jh7v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-qf3c-rw9f-jh7v/GHSA-qf3c-rw9f-jh7v.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-qf3c-rw9f-jh7v
Aliases
Published
2023-11-21T23:50:02Z
Modified
2024-11-22T18:27:49.427550Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Clear Text Credentials Exposed via Onboarding Task
Details

Impact

When credentials are provided while creating an OnboardingTask they may be visible via the Job Results view under the Additional Data tab as args for the Celery Task execution. This only applies to OnboardingTasks that are created with credentials specified while on v2.0.0-2.0.2 of Nautobot Device Onboarding. This advisory does not apply earlier version or when using NAPALMUSERNAME & NAPALMPASSWORD from nautobot_config.py

Patches

v3.0.0

Workarounds

None

Recommendations

  • Delete all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X
  • Upgrade to v3.0.0
  • Rotate any exposed credential
Database specific
{
    "nvd_published_at": "2023-11-21T23:15:08Z",
    "cwe_ids": [
        "CWE-200",
        "CWE-256"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-11-21T23:50:02Z"
}
References

Affected packages

PyPI / nautobot-device-onboarding

Package

Name
nautobot-device-onboarding
View open source insights on deps.dev
Purl
pkg:pypi/nautobot-device-onboarding

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
3.0.0

Affected versions

2.*

2.0.3