Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

acryl-datahub

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.9PyPIAmendedPublished

    acryl-datahub missing JWT signature check

    CVE-2022-39366 · GHSA-r8gm-v65f-c973

    Affected
    • PyPI acryl-datahub < 0.8.45
    Fixed in
    0.8.45· Vendor fix available
    Issue
    Missing JWT signature check (`GHSL-2022-078`) The `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the `parse` method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm. Impact This issue may lead to an…

    Recommended action: Upgrade to 0.8.45 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →