Comments (5)
A PR to address this is most welcome. Also if you provide the details of what value it will add to this lib and what effects this will make (e.g, compatibility) it would be easier to understand and contribute.
from suds-py3.
Hi @cackharot,
Thanks for your response, here is my analysis:
Analysis for file: suds/wsse.py
Occurrence in code:
def setnonce(self, text=None):
"""
Set I{nonce} which is arbitraty set of bytes to prevent
reply attacks.
@param text: The nonce text value.
Generated when I{None}.
@type text: str
"""
if text is None:
s = []
s.append(self.username)
s.append(self.password)
s.append(Token.sysdate())
m = md5()
m.update(':'.join(s).encode("utf-8"))
self.nonce = m.hexdigest()
else:
self.nonce = text
Issue
The above method uses the MD5 algorithm to generate the nonce that can be used to prevent the reply attacks. As MD5 is not FIPS compliant, the above method could fail on FIPS enabled platforms.
Resolution
While finding an alternative for the MD5, I found that the MD5 function is replaced by SHA-256 and SHA-512 in later versions of Digest Access Authentication (Method which we are using).
Impact
While MD5 produces the message digest that is 128 bit long, sha256 produces the message digest that is 256 bit long. But, as the nonces are the random number issued in the authentication, this should not affect anything.
Analysis for file: suds/reader.py
Occurrence in code:
def mangle(self, name, x):
"""
Mangle the name by hashing the I{name} and appending I{x}.
@return: the mangled name.
"""
h = hashlib.md5(name.encode('utf8')).hexdigest()
return '%s-%s' % (h, x)
Issue
The above method uses the MD5 algorithm to generate the nonce that can be used to prevent the reply attacks. As MD5 is not FIPS compliant, the above method could fail on FIPS enabled platforms.
Resolution
The above method mangles(generates the hash for) the name variable, appends it with x and returns it. The returned value is used as a name to cache and retrieve the vCenter Server properties.
Impact
Using the sha1 algorithm to generate hashes will provide a hash of 160 bits, which is a little longer than the hash provided by the md5 algorithm. It will not be an issue, as it will only be used as a name to get and set the cache.
from suds-py3.
I have opened a pull request to fix this issue :)
from suds-py3.
Done. Thanks!
from suds-py3.
Hi @cackharot,
Thanks for the quick action. Can you please tell me when the new version of the suds-py3 library is being released?
If it is going to take, what can be the procedure to make the above changes in the library which is already released and use it.?
Big thanks,
from suds-py3.
Related Issues (20)
- importing `suds.Object` class in mx.literal results in `TypeNotFound` later
- Exception: No ports defined: Service - wdsl without binding, how to handle?
- how to use import doctor to load schema from a local file
- cannot process href in build_catalog in multiref.py HOT 1
- Missing git tag for 1.4.1.0 release HOT 1
- suds-py3: Headers passed into suds.client.Client() are not used in WSDL and XSD requests HOT 2
- suds-py3 still vulnerable to CVE-2013-2217? HOT 5
- managing security with Handlerchain
- suds-py3: Exception: (BaseObjects, None, ), must be qref
- "suds.TypeNotFound: Type not found: 'BVDefs'" error when trying to call service
- Datetime Object formatting default
- HTTP error 415: content type error HOT 1
- release a wheel on pypi HOT 3
- Connection Pooling support? HOT 1
- nosend attribute for Client is documented, but doesn't appear to be implemented
- Is suds-py3 v1.4.5.0 is compatible with python3.11
- When recieves WebFault the recieved function in the message plugin is not called
- Omit __pycache__ directories from wheels
- Suds makes underscores in front of parsed fields
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from suds-py3.