Bug#1141510: marked as done (python3-bandit: bandit fails with all python programs)

Debian Bug Tracking System Tue, 07 Jul 2026 05:53:20 -0700

Your message dated Tue, 07 Jul 2026 12:48:48 +0000
with message-id <[email protected]>
and subject line Bug#1141510: fixed in bandit 1.9.4-1
has caused the Debian Bug report #1141510,
regarding python3-bandit: bandit fails with all python programs
to be marked as done.


This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


-- 
1141510: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141510
Debian Bug Tracking System
Contact [email protected] with problems

--- Begin Message ---

Package: python3-bandit
Version: 1.7.10-3
Severity: grave
Justification: renders package unusable
X-Debbugs-Cc: [email protected]

Running bandit even on a trivial test case such as this:

#! /usr/bin/env python3


def main() -> int:
    print("hello world")


if __name__ == "__main__":
    main()

Fails with the following error:

[main]  DEBUG   logging initialized
[main]  INFO    profile include tests: None
[main]  INFO    profile exclude tests: None
[main]  INFO    cli include tests: None
[main]  INFO    cli exclude tests: None
[test_set]      DEBUG   added function
any_other_function_with_shell_equals_true (B604) targeting Call
[test_set]      DEBUG   added function assert_used (B101) targeting Assert
[test_set]      DEBUG   added function django_extra_used (B610) targeting Call
[test_set]      DEBUG   added function django_mark_safe (B703) targeting Call
[test_set]      DEBUG   added function django_rawsql_used (B611) targeting Call
[test_set]      DEBUG   added function exec_used (B102) targeting Call
[test_set]      DEBUG   added function flask_debug_true (B201) targeting Call
[test_set]      DEBUG   added function hardcoded_bind_all_interfaces (B104)
targeting Constant
[test_set]      DEBUG   added function hardcoded_password_default (B107)
targeting FunctionDef
[test_set]      DEBUG   added function hardcoded_password_funcarg (B106)
targeting Call
[test_set]      DEBUG   added function hardcoded_password_string (B105)
targeting Constant
[test_set]      DEBUG   added function hardcoded_sql_expressions (B608)
targeting Constant
[test_set]      DEBUG   added function hardcoded_tmp_directory (B108) targeting
Constant
[test_set]      DEBUG   added function hashlib_insecure_functions (B324)
targeting Call
[test_set]      DEBUG   added function jinja2_autoescape_false (B701) targeting
Call
[test_set]      DEBUG   added function linux_commands_wildcard_injection (B609)
targeting Call
[test_set]      DEBUG   added function logging_config_insecure_listen (B612)
targeting Call
[test_set]      DEBUG   added function paramiko_calls (B601) targeting Call
[test_set]      DEBUG   added function pytorch_load_save (B614) targeting Call
[test_set]      DEBUG   added function request_with_no_cert_validation (B501)
targeting Call
[test_set]      DEBUG   added function request_without_timeout (B113) targeting
Call
[test_set]      DEBUG   added function set_bad_file_permissions (B103)
targeting Call
[test_set]      DEBUG   added function snmp_insecure_version (B508) targeting
Call
[test_set]      DEBUG   added function snmp_weak_cryptography (B509) targeting
Call
[test_set]      DEBUG   added function ssh_no_host_key_verification (B507)
targeting Call
[test_set]      DEBUG   added function ssl_with_bad_defaults (B503) targeting
FunctionDef
[test_set]      DEBUG   added function ssl_with_bad_version (B502) targeting
Call
[test_set]      DEBUG   added function ssl_with_no_version (B504) targeting
Call
[test_set]      DEBUG   added function start_process_with_a_shell (B605)
targeting Call
[test_set]      DEBUG   added function start_process_with_no_shell (B606)
targeting Call
[test_set]      DEBUG   added function start_process_with_partial_path (B607)
targeting Call
[test_set]      DEBUG   added function subprocess_popen_with_shell_equals_true
(B602) targeting Call
[test_set]      DEBUG   added function subprocess_without_shell_equals_true
(B603) targeting Call
[test_set]      DEBUG   added function tarfile_unsafe_members (B202) targeting
Call
[test_set]      DEBUG   added function trojansource (B613) targeting File
[test_set]      DEBUG   added function try_except_continue (B112) targeting
ExceptHandler
[test_set]      DEBUG   added function try_except_pass (B110) targeting
ExceptHandler
[test_set]      DEBUG   added function use_of_mako_templates (B702) targeting
Call
[test_set]      DEBUG   added function weak_cryptographic_key (B505) targeting
Call
[test_set]      DEBUG   added function yaml_load (B506) targeting Call
[test_set]      DEBUG   added function blacklist (B001) targeting Call
[test_set]      DEBUG   added function blacklist (B001) targeting Import
[test_set]      DEBUG   added function blacklist (B001) targeting ImportFrom
[main]  INFO    running on Python 3.14.6
[manager]       DEBUG   working on file : /home/tao/testcase.py
[node_visitor]  DEBUG   Module qualified name: testcase
[node_visitor]  DEBUG   FunctionDef(name='main', args=arguments(),
body=[Expr(value=Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world')]))], returns=Name(id='int', ctx=Load()))
[meta_ast]      DEBUG   adding node : 0x7f710aa56550 [0]
[node_visitor]  DEBUG   entering: 0x7f710aa56550 <class 'ast.FunctionDef'> [0]
[node_visitor]  DEBUG   {'imports': set(), 'import_aliases': {}, 'lineno': 4,
'col_offset': 0, 'end_col_offset': 24, 'node': FunctionDef(name='main',
args=arguments(posonlyargs=[], args=[], vararg=None, kwonlyargs=[],
kw_defaults=[], kwarg=None, defaults=[]), body=[Expr(value=Call(func=Name(...),
args=[Constant(...)], keywords=[]))], decorator_list=[], returns=Name(id='int',
ctx=Load()), type_comment=None, type_params=[]), 'linerange': [4, 5],
'filename': '/home/tao/testcase.py', 'file_data': <_io.BufferedReader
name='/home/tao/testcase.py'>}
[node_visitor]  DEBUG   visit_FunctionDef called (FunctionDef(name='main',
args=arguments(), body=[Expr(value=Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world')]))], returns=Name(id='int', ctx=Load())))
[tester]        DEBUG   Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor]  DEBUG   arguments()
[meta_ast]      DEBUG   adding node : 0x7f710aa56510 [1]
[node_visitor]  DEBUG   entering: 0x7f710aa56510 <class 'ast.arguments'> [1]
[node_visitor]  DEBUG   {'imports': set(), 'import_aliases': {}, 'node':
arguments(posonlyargs=[], args=[], vararg=None, kwonlyargs=[], kw_defaults=[],
kwarg=None, defaults=[]), 'linerange': [0, 1], 'filename':
'/home/tao/testcase.py', 'file_data': <_io.BufferedReader
name='/home/tao/testcase.py'>}
[tester]        DEBUG   Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor]  DEBUG   1       exiting : 0x7f710aa56510
[node_visitor]  DEBUG   Expr(value=Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world')]))
[meta_ast]      DEBUG   adding node : 0x7f710aa563d0 [1]
[node_visitor]  DEBUG   entering: 0x7f710aa563d0 <class 'ast.Expr'> [1]
[node_visitor]  DEBUG   {'imports': set(), 'import_aliases': {}, 'lineno': 5,
'col_offset': 4, 'end_col_offset': 24, 'node':
Expr(value=Call(func=Name(id='print', ctx=Load(...)),
args=[Constant(value='hello world', kind=None)], keywords=[])), 'linerange':
[5], 'filename': '/home/tao/testcase.py', 'file_data': <_io.BufferedReader
name='/home/tao/testcase.py'>}
[tester]        DEBUG   Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor]  DEBUG   Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world')])
[meta_ast]      DEBUG   adding node : 0x7f710aa56390 [2]
[node_visitor]  DEBUG   entering: 0x7f710aa56390 <class 'ast.Call'> [2]
[node_visitor]  DEBUG   {'imports': set(), 'import_aliases': {}, 'lineno': 5,
'col_offset': 4, 'end_col_offset': 24, 'node': Call(func=Name(id='print',
ctx=Load()), args=[Constant(value='hello world', kind=None)], keywords=[]),
'linerange': [5], 'filename': '/home/tao/testcase.py', 'file_data':
<_io.BufferedReader name='/home/tao/testcase.py'>}
[node_visitor]  DEBUG   visit_Call called (Call(func=Name(id='print',
ctx=Load()), args=[Constant(value='hello world')]))
[tester]        DEBUG   Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor]  DEBUG   Name(id='print', ctx=Load())
[meta_ast]      DEBUG   adding node : 0x7f710aa56350 [3]
[node_visitor]  DEBUG   entering: 0x7f710aa56350 <class 'ast.Name'> [3]
[node_visitor]  DEBUG   {'imports': set(), 'import_aliases': {}, 'lineno': 5,
'col_offset': 4, 'end_col_offset': 9, 'node': Name(id='print', ctx=Load()),
'linerange': [5], 'filename': '/home/tao/testcase.py', 'file_data':
<_io.BufferedReader name='/home/tao/testcase.py'>}
[tester]        DEBUG   Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor]  DEBUG   Load()
[meta_ast]      DEBUG   adding node : 0x7f710bd363d0 [4]
[node_visitor]  DEBUG   entering: 0x7f710bd363d0 <class 'ast.Load'> [4]
[node_visitor]  DEBUG   {'imports': set(), 'import_aliases': {}, 'node':
Load(), 'linerange': [0, 1], 'filename': '/home/tao/testcase.py', 'file_data':
<_io.BufferedReader name='/home/tao/testcase.py'>}
[tester]        DEBUG   Returning scores: {'SEVERITY': [0, 0, 0, 0],
'CONFIDENCE': [0, 0, 0, 0]}
[node_visitor]  DEBUG   4       exiting : 0x7f710bd363d0
[node_visitor]  DEBUG   3       exiting : 0x7f710aa56350
[node_visitor]  DEBUG   Constant(value='hello world')
[meta_ast]      DEBUG   adding node : 0x7f710aa562d0 [3]
[node_visitor]  DEBUG   entering: 0x7f710aa562d0 <class 'ast.Constant'> [3]
[node_visitor]  DEBUG   {'imports': set(), 'import_aliases': {}, 'lineno': 5,
'col_offset': 10, 'end_col_offset': 23, 'node': Constant(value='hello world',
kind=None), 'linerange': [5], 'filename': '/home/tao/testcase.py', 'file_data':
<_io.BufferedReader name='/home/tao/testcase.py'>}
[node_visitor]  DEBUG   visit_Constant called (Constant(value='hello world'))
[manager]       ERROR   Exception occurred when executing tests against
/home/tao/testcase.py.
[manager]       DEBUG     Exception string: 'Constant' object has no attribute
's'
[manager]       DEBUG     Exception traceback: Traceback (most recent call
last):
  File "/usr/lib/python3/dist-packages/bandit/core/manager.py", line 322, in
_parse_file
    score = self._execute_ast_visitor(fname, fdata, data, nosec_lines)
  File "/usr/lib/python3/dist-packages/bandit/core/manager.py", line 365, in
_execute_ast_visitor
    score = res.process(data)
  File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 286,
in process
    self.generic_visit(f_ast)
    ~~~~~~~~~~~~~~~~~~^^^^^^^
  File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 253,
in generic_visit
    self.generic_visit(item)
    ~~~~~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 253,
in generic_visit
    self.generic_visit(item)
    ~~~~~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 261,
in generic_visit
    self.generic_visit(value)
    ~~~~~~~~~~~~~~~~~~^^^^^^^
  File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 252,
in generic_visit
    self.visit(item)
    ~~~~~~~~~~^^^^^^
  File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 225,
in visit
    visitor(node)
    ~~~~~~~^^^^^^
  File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 159,
in visit_Constant
    self.visit_Str(node)
    ~~~~~~~~~~~~~~^^^^^^
  File "/usr/lib/python3/dist-packages/bandit/core/node_visitor.py", line 171,
in visit_Str
    self.context["str"] = node.s
                          ^^^^^^
AttributeError: 'Constant' object has no attribute 's'

[main]  DEBUG   Node: 0x7f710aa56550
        {'raw': FunctionDef(name='main', args=arguments(posonlyargs=[],
args=[], vararg=None, kwonlyargs=[], kw_defaults=[], kwarg=None, defaults=[]),
body=[Expr(value=Call(func=Name(...), args=[Constant(...)], keywords=[]))],
decorator_list=[], returns=Name(id='int', ctx=Load()), type_comment=None,
type_params=[]), 'parent_id': '', 'depth': 0}
Node: 0x7f710aa56510
        {'raw': arguments(posonlyargs=[], args=[], vararg=None, kwonlyargs=[],
kw_defaults=[], kwarg=None, defaults=[]), 'parent_id': '', 'depth': 1}
Node: 0x7f710aa563d0
        {'raw': Expr(value=Call(func=Name(id='print', ctx=Load(...)),
args=[Constant(value='hello world', kind=None)], keywords=[])), 'parent_id':
'', 'depth': 1}
Node: 0x7f710aa56390
        {'raw': Call(func=Name(id='print', ctx=Load()),
args=[Constant(value='hello world', kind=None)], keywords=[]), 'parent_id': '',
'depth': 2}
Node: 0x7f710aa56350
        {'raw': Name(id='print', ctx=Load()), 'parent_id': '', 'depth': 3}
Node: 0x7f710bd363d0
        {'raw': Load(), 'parent_id': '', 'depth': 4}
Node: 0x7f710aa562d0
        {'raw': Constant(value='hello world', kind=None), 'parent_id': '',
'depth': 3}
Length: 7

[main]  DEBUG   <bandit.core.metrics.Metrics object at 0x7f710abb70e0>
Run started:2026-07-05 17:31:35.562606

Test results:
        No issues identified.

Code scanned:
        Total lines of code: 4
        Total lines skipped (#nosec): 0

Run metrics:
        Total issues (by severity):
                Undefined: 0
                Low: 0
                Medium: 0
                High: 0
        Total issues (by confidence):
                Undefined: 0
                Low: 0
                Medium: 0
                High: 0
Files skipped (1):
        /home/tao/testcase.py (exception while scanning file)


Justification for severity:

* The tool is completely unusable since it fails on all program it's tested on
* Bandit is a security tool, and thus it's important that it works as well as
possible (obviously relying on just tools for security is a bad idea, but they
should still be used whenever possible)

The upstream version of Bandit is v1.9.4; I built a Debian package upgraded to
that version, and it seems to work just fine (after disabling the python-3.14
patch), so maybe the best solution is to simply package that version.


-- System Information:
Debian Release: forky/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 7.1.3+deb14-amd64 (SMP w/20 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages python3-bandit depends on:
ii  python3                    3.14.6-1
ii  python3-git                3.1.50-1
ii  python3-jschema-to-python  1.2.3-3
ii  python3-rich               15.0.0-1
ii  python3-sarif-python-om    1.0.4-3
ii  python3-stevedore          5.7.0-3
ii  python3-yaml               6.0.3-1

python3-bandit recommends no packages.

python3-bandit suggests no packages.

-- no debconf information

--- End Message ---

--- Begin Message ---

Source: bandit
Source-Version: 1.9.4-1
Done: Thomas Goirand <[email protected]>

We believe that the bug you reported is fixed in the latest version of
bandit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated bandit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 07 Jul 2026 14:24:30 +0200
Source: bandit
Architecture: source
Version: 1.9.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1141510
Changes:
 bandit (1.9.4-1) unstable; urgency=medium
 .
   * New upstream release.
     - works (Closes: #1141510).
   * Removed python-3.14-compat.patch.
Checksums-Sha1:
 e0023adaeea2746e727689d09238a39e5b2563aa 2338 bandit_1.9.4-1.dsc
 dfa880fd64240855399c720fa32ce85a344b6d53 3817000 bandit_1.9.4.orig.tar.xz
 2f4cd9c8e1b6ac3bdea7c82aad14f2060059d8cf 4812 bandit_1.9.4-1.debian.tar.xz
 18c3c3198ea42d9de16a06e63032801667cddb70 11007 bandit_1.9.4-1_amd64.buildinfo
Checksums-Sha256:
 0c7a3c070a4aa7612f9b40fca686b18669f01301d923b1b8844a042ba4056020 2338 
bandit_1.9.4-1.dsc
 fd8150992874e3a59e11ed17d855b6bf9d676617bce9330090750ccecbf1402c 3817000 
bandit_1.9.4.orig.tar.xz
 43f9a3c8f0c9845efc4d5c79007f05526db6c2dae692aeddb240dacbbd6cef12 4812 
bandit_1.9.4-1.debian.tar.xz
 f333205963b9cf7c487907cf1ad32ceeb4b7848c4292cdadf58327fec7ca2b70 11007 
bandit_1.9.4-1_amd64.buildinfo
Files:
 27054238bfa8c9d5af8649729f7a513f 2338 python optional bandit_1.9.4-1.dsc
 f951bdb3a564b727119b48f060df8f7a 3817000 python optional 
bandit_1.9.4.orig.tar.xz
 12191d4a901035b6e14e78b145bfdc7c 4812 python optional 
bandit_1.9.4-1.debian.tar.xz
 8d48adcfd026e01ba4ba3b170ff66b9e 11007 python optional 
bandit_1.9.4-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmpM8LwACgkQ1BatFaxr
Q/5VERAAlN67vbs0U2jK3SHHv9f5ZSHq7LAUBgEZVct2BoBJmBx/7TBB/TnUsSs5
3fWc0UwaDmLJm4MPhniRTLYEYNUOsrNnxDOtEhlqgWZVVsbh+lalQV4848Rklmux
Cff2aAxVyfFaTP/F35L85biU4D25G504swlATcRaTJT7gZrmGKwPU2mMRiBLRRII
e2+AauYVSxoB4nkh9VI2qvyX+yCSz7FV4o14RS/bRSnfN/5GGcAKyHF+vWwCzpai
3+XPXU8ssih4U8/t26ntB9ARz04n2hWNfohsX/vruB4GP9OBImQFW2ufECVde/g2
H4qtStJEQn+0hL90dPd4QAN8XXvCTSk48iPv3aYa5peCixeoecmxKFbSAw3Fih0D
1KPKK3lz5Lpgoy3R0dwScfY5R7iHG3kmiR7kc9jyDZNvf72tejnkSMrAJ6bU4a8e
esDgA5Mu0OVaJUNnzUfAwRNi/yN3iyuwuu00l50IgrQB4RvyG5mojzoHnumRhv/h
FSQe88ekUK1T5oYOAvpkUYRtMnTfF4lcF8DK9pNR+2cLW+sq4tKxDH+WBRUdbyy8
/Sf2YObz4BdnXkNul5P7ItlvcnDzkpzrGHddFm7aWiFRsjSTLjqtXA+fAfy0PL3y
GsteM5Su12Ofnpbh02C/SLlDt0mf3yytzEwQWM9x1HkMsLKbAzk=
=IPM9
-----END PGP SIGNATURE-----

pgpY5WqKQ9giv.pgp
Description: PGP signature

--- End Message ---

Bug#1141510: marked as done (python3-bandit: bandit fails with all python programs)

Reply via email to