GHSA-r4xg-4wrv-w72h

Source

https://github.com/advisories/GHSA-r4xg-4wrv-w72h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-r4xg-4wrv-w72h

Withdrawn

2024-09-30T18:51:02Z

Published

2023-04-19T21:30:27Z

Modified

2024-11-30T05:35:05Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Duplicate Advisory: Lemur subject to insecure random generation

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5fqv-mpj8-h7gm. This link is maintained to preserve external references.

Original Description

Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.

Database specific

{
    "cwe_ids":  [
        "CWE-330"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-09-30T18:51:02Z",
    "nvd_published_at":  "2023-04-19T20:15:12Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / lemur

Package

Name: lemur; View open source insights on deps.dev
Purl: pkg:pypi/lemur

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.3.2

Affected versions

0.*

0.2.1

0.8.0

0.8.1

0.9.0

0.11.0

1.*

1.0.0

1.1.0

1.2.0

1.3.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-r4xg-4wrv-w72h/GHSA-r4xg-4wrv-w72h.json"