Skip to content

fix(anta.tests): Preserve SA178 hotfix mitigation evidence - #5

Merged
gmuloc merged 2 commits into
carl-baillargeon:fix/sa178-snmp-remote-usersfrom
gmuloc:fix/sa178-hotfix-assessment
Oct 30, 2026
Merged

gmuloc merged 2 commits into
carl-baillargeon:fix/sa178-snmp-remote-usersfrom
gmuloc:fix/sa178-hotfix-assessment

Conversation

@gmuloc

@gmuloc gmuloc commented Oct 30, 2026

Copy link
Copy Markdown

When SA178 finds encrypted SNMPv3 credentials on an affected release with its applicable persistent SWIX hotfix, report Mitigated instead of Not Affected. Retain the hotfix as mitigation evidence and the encrypted credential syntax as supporting context, and provide fixed-release guidance. ANTA still reports Success.

This PR targets the branch behind aristanetworks#1856.

Allow MitigatedResult.context to carry existing finding evidence. Keep the shared projector unchanged. Preserve the general encrypted-credentials fallback, immediate Not Affected results for absent prerequisites, and existing legacy-credential remediation. Consolidate the legacy result construction without return-count lint suppressions.

Credentials EOS version Hotfix Assessment Remediation
Legacy Affected Effective and applicable Affected Convert credentials
Legacy Affected Absent or ineffective Affected Upgrade, then convert credentials
Legacy Affected Not applicable Affected Upgrade, then convert credentials
Legacy Fixed Any; ignored Affected Convert credentials
Encrypted Affected Effective and applicable Mitigated Fixed-release upgrade guidance
Encrypted Affected Absent or ineffective Not Affected None
Encrypted Affected Not applicable Not Affected None
Encrypted Fixed Any; ignored Not Affected None
Not configured, or no authentication keys Any, including unknown Any, including unknown Not Affected None

An effective applicable hotfix must be boot-persistent and match one of the exact eligible releases. Encrypted inputs without a confirmed applicable effective hotfix retain the existing fallback; the table does not assert that EOS normally produces those combinations. Otherwise, unavailable facts required to decide exposure produce Error.

Validation:

  • Focused advisory, finding, and docstring tests: 788 passed.
  • Changed-file and all-files pre-commit: all hooks passed.
  • Strict documentation build: no issues found.
  • A 10-case assessment and projection probe verified the credential, release, hotfix, and remediation combinations.

@gmuloc
gmuloc merged commit c80df5e into carl-baillargeon:fix/sa178-snmp-remote-users Oct 30, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant