{"action":"Upgrade lemur to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"}],"component":"lemur","cve_ids":["CVE-2023-30797"],"ecosystem":"PyPI","epss":0.00791,"exploited":false,"fixed_versions":["1.3.2"],"ghsa_id":"GHSA-5fqv-mpj8-h7gm","id":"tcs_01M5KGJV5CV522D85P68GTBVCB","modified_at":"2023-11-08T04:12:26.777742Z","published_at":"2023-04-19T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2023-20","https://vulncheck.com/advisories/netflix-lemur-weak-rng","https://github.com/Netflix/lemur/commit/666d853212174ee7f4e6f8b3b4b389ede1872238","https://github.com/Netflix/lemur/security/advisories/GHSA-5fqv-mpj8-h7gm","https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2023-001.md"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2023-20","url":"https://osv.dev/vulnerability/PYSEC-2023-20"}],"summary":"Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain acces"}