[dependabot]

Bumps github.com/gosnmp/gosnmp from 1.46.0 to 1.47.0.

Release notes

Sourced from github.com/gosnmp/gosnmp's releases.

v1.47.0

Security

Fixes SNMPv3 authentication bypasses and remote panics, see GHSA-w96x-5v55-24xx. All users of SNMPv3, and especially of the trap listener, should upgrade.

Behaviour changes

• v3 traps: a user in a trap security parameters table that requires authentication no longer accepts unauthenticated traps
• v3 traps: only a reportable GetRequest with no varbinds is treated as an engine discovery request, and discovery requests are never passed to OnNewTrap
• UnmarshalTrap(buf, true) with a single SecurityParameters rejects traps whose user name differs from the configured one
• v3 client: engine discovery fails if the REPORT's engine ID is empty or not 5-32 bytes

Full Changelog: gosnmp/gosnmp@v1.46.0...v1.47.0

Changelog

Sourced from github.com/gosnmp/gosnmp's changelog.

v1.47.0

• [CHANGE] v3 traps: a user in a trap security parameters table that requires authentication no longer accepts unauthenticated traps GHSA-w96x-5v55-24xx
• [CHANGE] v3 traps: only a reportable GetRequest with no varbinds is treated as an engine discovery request, and discovery requests are never passed to OnNewTrap GHSA-w96x-5v55-24xx
• [CHANGE] UnmarshalTrap(buf, true) with a single SecurityParameters rejects traps whose user name differs from the configured one GHSA-w96x-5v55-24xx
• [CHANGE] v3 client: engine discovery fails if the REPORT's engine ID is empty or not 5-32 bytes GHSA-w96x-5v55-24xx
• [BUGFIX] Security: fix SNMPv3 authentication bypasses in the trap listener and client, and remote panics on malformed msgAuthenticationParameters or a table-only UDP trap listener GHSA-w96x-5v55-24xx

Commits

• dd424be Merge commit from fork
• 0f2b959 Fix SNMPv3 authentication bypasses and remote panics (GHSA-w96x-5v55-24xx)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)