From 8bdac1db4e86e9d6be42532d562488053eaf5c3e Mon Sep 17 00:00:00 2001 From: Dan Guido Date: Fri, 30 Jan 2026 01:10:12 -0500 Subject: [PATCH] security: remove unused sshpubkeys dependency (CVE-2024-23342) (#14957) Remove sshpubkeys from cloudstack extras to eliminate the vulnerable python-ecdsa transitive dependency. The sshpubkeys package was declared but never actually imported or used anywhere in the codebase - CloudStack role uses Ansible collection modules, not this Python package. CVE-2024-23342 is a high severity Minerva timing attack affecting all versions of python-ecdsa with no fix planned by maintainers. Co-authored-by: Claude Opus 4.5 --- pyproject.toml | 1 - uv.lock | 27 --------------------------- 2 files changed, 28 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index e2f38223..914abb6b 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -46,7 +46,6 @@ openstack = [ ] cloudstack = [ "cs>=3.0.0", - "sshpubkeys>=3.3.1", ] [tool.ruff] diff --git a/uv.lock b/uv.lock index 01b64f8d..2d1cdc85 100644 --- a/uv.lock +++ b/uv.lock @@ -46,7 +46,6 @@ azure = [ ] cloudstack = [ { name = "cs" }, - { name = "sshpubkeys" }, ] gcp = [ { name = "google-auth" }, @@ -90,7 +89,6 @@ requires-dist = [ { name = "pyyaml", specifier = ">=6.0.2" }, { name = "requests", marker = "extra == 'gcp'", specifier = ">=2.31.0" }, { name = "segno", specifier = ">=1.6.0" }, - { name = "sshpubkeys", marker = "extra == 'cloudstack'", specifier = ">=3.3.1" }, ] provides-extras = ["aws", "azure", "gcp", "hetzner", "linode", "openstack", "cloudstack"] @@ -596,18 +594,6 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/fb/91/6191ee1b821a03ed2487f234b11c58b0390c305452cf31e1e33b4a53064d/dogpile_cache-1.4.0-py3-none-any.whl", hash = "sha256:f1581953afefd5f55743178694bf3b3ffb2782bba3d9537566a09db6daa48a63", size = 62881, upload-time = "2025-04-26T17:45:44.804Z" }, ] -[[package]] -name = "ecdsa" -version = "0.19.1" -source = { registry = "https://pypi.org/simple" } -dependencies = [ - { name = "six" }, -] -sdist = { url = "https://files.pythonhosted.org/packages/c0/1f/924e3caae75f471eae4b26bd13b698f6af2c44279f67af317439c2f4c46a/ecdsa-0.19.1.tar.gz", hash = "sha256:478cba7b62555866fcb3bb3fe985e06decbdb68ef55713c4e5ab98c57d508e61", size = 201793, upload-time = "2025-03-13T11:52:43.25Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/cb/a3/460c57f094a4a165c84a1341c373b0a4f5ec6ac244b998d5021aade89b77/ecdsa-0.19.1-py2.py3-none-any.whl", hash = "sha256:30638e27cf77b7e15c4c4cc1973720149e1033827cfd00661ca5c8cc0cdb24c3", size = 150607, upload-time = "2025-03-13T11:52:41.757Z" }, -] - [[package]] name = "execnet" version = "2.1.1" @@ -1488,19 +1474,6 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/b7/ce/149a00dd41f10bc29e5921b496af8b574d8413afcd5e30dfa0ed46c2cc5e/six-1.17.0-py2.py3-none-any.whl", hash = "sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274", size = 11050, upload-time = "2024-12-04T17:35:26.475Z" }, ] -[[package]] -name = "sshpubkeys" -version = "3.3.1" -source = { registry = "https://pypi.org/simple" } -dependencies = [ - { name = "cryptography" }, - { name = "ecdsa" }, -] -sdist = { url = "https://files.pythonhosted.org/packages/a3/b9/e5b76b4089007dcbe9a7e71b1976d3c0f27e7110a95a13daf9620856c220/sshpubkeys-3.3.1.tar.gz", hash = "sha256:3020ed4f8c846849299370fbe98ff4157b0ccc1accec105e07cfa9ae4bb55064", size = 59210, upload-time = "2021-02-04T12:24:32.101Z" } -wheels = [ - { url = "https://files.pythonhosted.org/packages/e3/76/bc71db2f6830196554e5a197331ad668c049a12fb331075f4f579ff73cb4/sshpubkeys-3.3.1-py2.py3-none-any.whl", hash = "sha256:946f76b8fe86704b0e7c56a00d80294e39bc2305999844f079a217885060b1ac", size = 10472, upload-time = "2021-02-04T12:24:30.533Z" }, -] - [[package]] name = "stevedore" version = "5.4.1"