CVE-2022-39366
2 advisories.
PyPI/acryl-datahub CVE-2022-39366: critical 9.9
acryl-datahub missing JWT signature check
Action: Upgrade acryl-datahub to 0.8.45 or later.
pip install acryl-datahub==0.8.45Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.8.45 | - |
Fixed versions
| 0.8.45 |
Sources
- osv: GHSA-r8gm-v65f-c973
- https://github.com/datahub-project/datahub/security/advisories/GHSA-r8gm-v65f-c973
- https://nvd.nist.gov/vuln/detail/CVE-2022-39366
- https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check
- https://github.com/datahub-project/datahub
- https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134
- https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30
- https://github.com/datahub-project/datahub/releases/tag/v0.8.45
CVE-2022-39366 · published · modified · JSON
PyPI/acryl-datahub CVE-2022-39366: critical 9.9
acryl-datahub missing JWT signature check
Action: Upgrade acryl-datahub to 0.8.45 or later.
pip install acryl-datahub==0.8.45Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.8.45 | - |
Fixed versions
| 0.8.45 |
Sources
- osv: PYSEC-2026-252
- https://github.com/datahub-project/datahub/security/advisories/GHSA-r8gm-v65f-c973
- https://nvd.nist.gov/vuln/detail/CVE-2022-39366
- https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check
- https://github.com/datahub-project/datahub
- https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134
- https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30
- https://github.com/datahub-project/datahub/releases/tag/v0.8.45
- https://pypi.org/project/acryl-datahub
- https://github.com/advisories/GHSA-r8gm-v65f-c973
CVE-2022-39366 · published · modified · JSON