Em resumo
- CVE-2023-30797 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta lemur, lemur (netflix).
- Chance de exploração nos próximos 30 dias (EPSS): 0.79%, maior que 56.3% das vulnerabilidades.
- Correção: atualize para 1.3.2 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| lemur PyPI | < 1.3.2
| 1.3.2
|
| lemur | < 1.3.2
| 1.3.2
|
Description
Overview
Lemur was using insecure random generation for its example configuration file, as well as for some utilities.
Impact
The potentially affected generated items include:
| Configuration item | Config option name (if applicable) | Documentation link (if applicable) | Rotation option | Code reference(s) |
|---|
| Flask session secret | SECRET_KEY | Flask documentation | Generate a new secret and place in config; all existing sessions will be invalidated | N/A, internal to Flask |
| Lemur token secret | LEMUR_TOKEN_SECRET | Lemur's configuration documentation | Generate a new secret and place in config; all existing JWTs will be invalidated and must be regenerated (including API keys) | 1, 2 |
| Lemur database encryption key | LEMUR_ENCRYPTION_KEYS | Lemur's configuration documentation | A new key can be generated and added to this list, but existing data encrypted with prior keys cannot be re-encrypted unless you write a custom re-encryption process | 1 |
| OAuth2 state token secret key | OAUTH_STATE_TOKEN_SECRET | Lemur's configuration documentation | Generate a new secret and place in config | 1 |
| Randomly generated passphrases for openssl keystores |
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free