Go/github.com/flyteorg/flyteadmin CVE-2022-39273: high 7.5, EPSS 0.93%

FlyteAdmin's Default OAuth Authorization Server secret must be rotated

Action: Upgrade github.com/flyteorg/flyteadmin to 1.1.44 or later.

go get github.com/flyteorg/flyteadmin@v1.1.44

Affected

Fixed versions

Sources

• osv: GHSA-67x4-qr35-qvrm
• https://github.com/flyteorg/flyteadmin/security/advisories/GHSA-67x4-qr35-qvrm
• https://nvd.nist.gov/vuln/detail/CVE-2022-39273
• https://github.com/flyteorg/flyteadmin/pull/478
• https://github.com/flyteorg/flyteadmin/commit/281172edf55fe6800959238fc128964ead6d9101
• https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html#oauth2-authorization-server
• https://github.com/flyteorg/flyteadmin
• https://pkg.go.dev/vuln/GO-2022-1043

CVE-2022-39273 · published 2022-10-05T21:26:26Z · modified 2024-05-20T21:35:54Z · JSON