GO-2022-1043

vendorUSosv

Hardcoded hashed password in github.com/flyteorg/flyteadmin

view advisory published 2022-10-31Licence: per source

Default authorization server's configuration settings contain a known hardcoded hashed password. Users who enable auth but do not override this setting may unknowingly allow public traffic in by way of this default password with attackers effectively impersonating propeller.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-39273US	high7.5OT elevated	0.93% (60th)	—	2022-10-06
FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will…

references

External citations — patches, advisories, analysis.

https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-serverWEB
https://github.com/advisories/GHSA-67x4-qr35-qvrmADVISORY
https://github.com/flyteorg/flyteadmin/pull/478FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan