test repo: Bandit code scan report of high severity security vulnerabilit

Bug #1875562 reported by sharath kumar
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
StarlingX
Triaged
Low
Unassigned

Bug Description

>> Issue: [B401:blacklist] A telnet-related module is being imported. Telnet is considered insecure. Use SSH or some other encrypted protocol.
   Severity: High Confidence: High
   Location: ./test/automated-pytest-suite/utils/clients/telnet.py:11
   More Info: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b401-import-telnetlib
 import time
 from telnetlib import Telnet, theNULL, DO, DONT, WILL, WONT, NOOPT, IAC, \
     SGA, ECHO, SE, SB

 from consts.auth import HostLinuxUser

--------------------------------------------------
>> Issue: [B605:start_process_with_a_shell] Starting a process with a shell, possible injection detected, security issue.
   Severity: High Confidence: High
   Location: ./test/automated-robot-suite/Libraries/iso_setup.py:72
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b605_start_process_with_a_shell.html

         os.system('{term} -geometry {geo} -T {title} -e {cmd} &'.format(
             term=terminal, geo=geometry, title=terminal_title, cmd=command))

--------------------------------------------------
>> Issue: [B602:subprocess_popen_with_shell_equals_true] subprocess call with shell=True identified, security issue.
   Severity: High Confidence: High
   Location: ./test/automated-robot-suite/Utils/bash_utils.py:109
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html
     proc = subprocess.Popen(
         command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell=True,
         executable='/bin/bash')
     output, error = proc.communicate()
     output = output.strip() if output else output

Revision history for this message
Ghada Khalil (gkhalil) wrote :

The priority of addressing bandit findings need to be discussed with the TSC. At this time, this work is unplanned.

tags: added: stx.tools
Changed in starlingx:
status: New → Triaged
importance: Undecided → Low
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.