Apache Submarine Commons Utils has a hard-coded secret

緊急 9.8CVE-2024-36264 · GHSA-jwcg-wv5x-vg3g · PYSEC-2024-97 · 12/06/2024 公開 · 17/06/2026 更新

要点

CVE-2024-36264 は org.apache.submarine:submarine-commons-utils, apache-submarine, submarine (apache) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 63.4% より高い）。
修正版の情報はまだありません。参考情報のベンダー勧告を確認してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.submarine:submarine-commons-utils Maven	`≤ 0.8.0`	修正版なし
apache-submarine PyPI	`≥ 0.8.0`	修正版なし
submarine apache	`≥ 0.8.0`	修正版なし

概要

Improper Authentication vulnerability in Apache Submarine Commons Utils.

This issue affects Apache Submarine Commons Utils: from 0.8.0.

As this project is retired, we do not plan to release a version that fixes this issue. If the user doesn't explicitly set submarine.auth.default.secret, a default value will be used. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NVD の説明

** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.default.secret`, a default value will be used. This issue affects Apache Submarine Commons Utils: from 0.8.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.