Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact List endpoints on Flyte Admin has a SQL vulnerability where a malicious user can send a REST requests with custom SQL statements as list filters. Workarounds The attacker needs to have access to the flyteadmin installation (typically either behind a VPN or authentication). References https://owasp.org/www-community/attacks/SQLInjection#
Recommended action: Upgrade to 1.1.124 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte administrators, the default configuration for Flyte Admin allows access for Flyte Propeller even after turning on authentication via a hardcoded hashed password. This password is also set on the default Flyte Propeller configmap in the various Flyte Helm charts. Users who enable auth but do not override this setting in Flyte Admin’s configuration may unknowingly allow public traffic in by way of this default password with attackers effectively impersonating propeller. This only applies to users who have not specified the ExternalAuthorizationServer setting. Using an external auth server automatically turns off this default configuration is not susceptible to this vulnerability. Patches 1.1.44 Workarounds Users should manually set the staticClients in the selfAuthServer…
Recommended action: Upgrade to 1.1.44 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Using flyteadmin as the OAuth2 Authorization Server is unaffected by this issue. Patches 1.1.30 Workarounds Rotating signing keys immediately will: Invalidate all open sessions, Force all users to attempt to obtain new tokens. Continue to rotate keys until flyteadmin has been upgraded, Hide flyteadmin deployment ingress url from the internet. References https://github.com/flyteorg/flyteadmin/pull/455 For more information If you have any questions or comments about this advisory: Open an issue in flyte repo Email us at flyte
Recommended action: Upgrade to 1.1.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.