- WS-Management answers are parsed with defusedxml (new dependency,
defusedxml>=0.7) with DTDs forbidden. The check for "<!DOCTYPE" in the raw
bytes it replaces missed a DTD in a UTF-16 answer, which expat reads too;
on plain HTTP (16992) anyone in the path can send one. An answer with a
DTD in any encoding is now refused as no WS-Management answer, as a UTF-8
one already was (B314, B405).
- xml.sax.saxutils only escapes the request envelopes, nothing parses with
SAX (nosec B406).
- python -m napalm_amt.record fetches the landing page without certificate
checks, as before: it sends no credentials and records what discovery
sees, and AMT's certificate is self-signed unless one was provisioned
(nosec B501). The driver itself still verifies by default (verify_ssl).
christianmanivong
76f85051cc