B509: snmp_weak_cryptography¶

bandit.plugins.snmp_security_check.snmp_crypto_check(context)[source]

B509: Checking for weak cryptography

This test is for checking for the usage of insecure SNMP cryptography:: v3 using noAuthNoPriv.

Please update your code to use more secure versions of SNMP. For example:

Instead of:: CommunityData(‘public’, mpModel=0)
Use (Defaults to usmHMACMD5AuthProtocol and usmDESPrivProtocol: UsmUserData(“securityName”, “authName”, “privName”)

Example:

>> Issue: [B509:snmp_crypto_check] You should not use SNMPv3 without encryption. noAuthNoPriv & authNoPriv is insecure
   Severity: Medium CWE: CWE-319 (https://cwe.mitre.org/data/definitions/319.html) Confidence: High
   Location: examples/snmp.py:6:11
   More Info: https://bandit.readthedocs.io/en/latest/plugins/b509_snmp_crypto_check.html
5   # SHOULD FAIL
6   insecure = UsmUserData("securityName")
7   # SHOULD FAIL