CVE-2022-39238

ALTO 8.8CVE-2022-39238 · Published 23/09/2022 · updated 17/06/2026

En resumen

CVE-2022-39238 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a arvados (arvados).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.50%, mayor que el 43.3% de las vulnerabilidades.
Solución: actualizar a 2.4.3 o posterior.

Package	Affected versions	Patched versions
arvados arvados	`< 2.4.3`	`2.4.3`

Description

Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM) for user authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host (such as an expired password), it would still be accepted for access to Arvados. Other authentication methods (LDAP, OpenID Connect) supported by Arvados are not affected by this flaw. This issue is patched in version 2.4.3. Workaround for this issue is to migrate to a different authentication method supported by Arvados, such as LDAP.

References

arvados/arvados security advisory · Third Party Advisory

Más vulnerabilidades de arvados

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free