Security Vulneratbility CVE-2022-40899 on future 0.18.2

MefhigosetH commented 1 year ago

Hi there,

pyzk depends on future package, that currently has a Security Vulnerability. As stated in the upstream issue https://github.com/PythonCharmers/python-future/issues/612 this project is more or less dead, because Python v2 has been dead too for a long time.

So maybe, the best option is to remove all references to this library from the pyzk project, so you can eliminate the future dep.

We have been using pyzk on Python v3.10.1 with no issues, pulling data from a SC405 device and firmware version Ver 6.60 Sep 19 2019

kurenai-ryu commented 1 year ago

can you test the PR before merging here?

MefhigosetH commented 1 year ago

Sure.

MefhigosetH commented 1 year ago

Dear @kurenai-ryu ,

I just test the branch #kurenai-ryu:issue/162/remove-future with our device and works well with a simplified version of script basic_test.py:

$ python --version      
Python 3.10.1

$ git status
On branch issue/162/remove-future
Your branch is up to date with 'origin/issue/162/remove-future'.

$ python .\basic_test.py
Connecting to device ...
Firmware Version: : Ver 6.60 Sep 19 2019
Platform         : ZLM60_TFT
DeviceName       : SC405
Pin Width        : 9
Serial Number    : AJA6212######
MAC: 00:17:61:##:##:##

- UID #1
  Name       : #### ##########
  Privilege  : Admin
  Password   :
  Group ID   :
  User  ID   : 1
- UID #2
  Name       : ###### ##############
  Privilege  : Admin
  Password   :
  Group ID   :
  User  ID   : 2

Voice Test ...
Enabling device ...

I think, maybe we can add this device model to the working devices list, too.

Is it enough with these tests? Or do you need me to try something else?

fananimi / pyzk

Security Vulneratbility CVE-2022-40899 on future 0.18.2 #162