Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xZjNjLXJ3OWYtamg3ds4AA3S4

Clear Text Credentials Exposed via Onboarding Task

Impact

When credentials are provided while creating an OnboardingTask they may be visible via the Job Results view under the Additional Data tab as args for the Celery Task execution. This only applies to OnboardingTasks that are created with credentials specified while on v2.0.0-2.0.2 of Nautobot Device Onboarding. This advisory does not apply earlier version or when using NAPALM_USERNAME & NAPALM_PASSWORD from nautobot_config.py

Patches

v3.0.0

Workarounds

None

Recommendations

• Delete all Job Results for any onboarding task to remove clear text credentials from database entries that were run while on v2.0.X
• Upgrade to v3.0.0
• Rotate any exposed credential

Permalink: https://github.com/advisories/GHSA-qf3c-rw9f-jh7v
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xZjNjLXJ3OWYtamg3ds4AA3S4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 10 days ago

CVSS Score: 5.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Identifiers: GHSA-qf3c-rw9f-jh7v, CVE-2023-48700
References:

• https://github.com/nautobot/nautobot-plugin-device-onboarding/security/advisories/GHSA-qf3c-rw9f-jh7v
• https://nvd.nist.gov/vuln/detail/CVE-2023-48700
• https://github.com/pypa/advisory-database/tree/main/vulns/nautobot-device-onboarding/PYSEC-2023-288.yaml
• https://github.com/advisories/GHSA-qf3c-rw9f-jh7v

Repository: https://github.com/nautobot/nautobot-plugin-device-onboarding
Blast Radius: 0.0

Affected Packages