Check for PyCryptodome and PyCryptodomex in weak key plugin
Bug #1655975 reported by
Ian Cordasco
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Bandit |
Fix Released
|
Undecided
|
Ian Cordasco | ||
Bug Description
With PyCrypto unmaintained, hostile forks are present - the most prominent of which is PyCryptodome (https:/
This project has two installable PyPI targets:
- PyCryptodome
- PyCryptodomex
The former provides a drop in replacement for PyCrytpo so we should be able to catch imports using the existing plugin (import Crypto).
The latter provides a different module: Cryptodome which provides similar functionality but under a new name. This should be added to the weak key check.
Revision history for this message
| OpenStack Infra (hudson-openstack) wrote Fix merged to bandit (master) | #1 |
| Changed in bandit: | |
| status: | New → Fix Released |
To post a comment you must log in.
Reviewed: https:/
Committed: https:/
Submitter: Jenkins
Branch: master
commit d4e213445aa4e58
Author: Eric Brown <email address hidden>
Date: Thu Jan 12 23:53:24 2017 -0800
Add Cryptodome to blacklist and weak ciphers/hash
As stated in the bug, the PyCryptodomex package reintroduces
PyCrypto, but with a different namespace. Therefore Bandit should
also include Cryptodome in its checks.
Change-Id: I6a02f97747420c
Closes-Bug: #1655975