NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cach…
Critical CVSS 9.6
Summary
NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the read_pickle_data function in tests/pickle_operations.py. An unauthenticated contributor can change USE_LOCAL_KNOWN_SLUGS in tests/test_configuration.py and supply a crafted tests/known-modules.pickle or tests/known-racks.pickle file that tests/definitions_test.py l…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/netbox-community/devicetype-library/commit/1c6f7e2b93589b965318c6e67ac3504831f0e71e
- https://github.com/netbox-community/devicetype-library/pull/4238
- https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-492p-5wp7-2w7c
- https://github.com/netbox-community/devicetype-library/security/advisories/GHSA-492p-5wp7-2w7c
Timeline
- nvd_ingest NVD