GitHub Advisoryadvisory · PyPI

GHSA-r8gm-v65f-c973 acryl-datahub missing JWT signature check

CRITICAL Published 2022-10-31 Modified 2026-10-26 Official page ↗
Aliases
CVE-2022-39366
Ecosystem
PyPI
Packages
acryl-datahub
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L
Weaknesses
CWE-347
Reviewed
2022-10-31

Affected packages

• PyPI acryl-datahub: < 0.8.45 → fixed in 0.8.45

Description

Missing JWT signature check (`GHSL-2022-078`) The `StatelessTokenService` of the DataHub metadata service (GMS) does not verify the signature of JWT tokens. This allows an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This vulnerability occurs because the `StatelessTokenService` of the Metadata service uses the `parse` method of `io.jsonwebtoken.JwtParser`, which does not perform a verification of the cryptographic token signature. This means that JWTs are accepted regardless of the used algorithm. Impact This issue may lead to an authentication bypass. Resources • CodeQL: Missing JWT signature check

Related

Alias · CVE (1)

  • CVE-2022-39366 DataHub is an open-source metadata platform. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References