CVE-2024-29037

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-29037
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-29037.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-29037
Aliases
  • GHSA-82p6-9h7m-9h8j
Published
2024-03-20T20:42:19.398Z
Modified
2025-12-05T10:09:25.160226Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Default secret use for initial deployment
Details

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during window of releases. If someone circumvented the helm settings and manually set Metadata Service Authentication to be enabled using environment variables directly, this would skip over the autogeneration logic for the Kubernetes Secrets and DataHub GMS would default to the signing key specified statically in the application.yml. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized. Version 0.2.182 contains a patch for this issue. As a workaround, one may reset the token signing key to be a random value, which will invalidate active personal access tokens.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29037.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1394"
    ]
}
References

Affected packages

Git / github.com/acryldata/datahub-helm

Affected ranges

Type
GIT
Repo
https://github.com/acryldata/datahub-helm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea8a17860f053c63387b8309e1f77c0e1462a1b3

Affected versions

0.*
0.2.108
0.2.109
0.2.110
0.2.111
datahub-0.*
datahub-0.1.2
datahub-0.2.0
datahub-0.2.1
datahub-0.2.10
datahub-0.2.100
datahub-0.2.101
datahub-0.2.102
datahub-0.2.103
datahub-0.2.104
datahub-0.2.105
datahub-0.2.106
datahub-0.2.107
datahub-0.2.108
datahub-0.2.109
datahub-0.2.11
datahub-0.2.110
datahub-0.2.111
datahub-0.2.112
datahub-0.2.113
datahub-0.2.114
datahub-0.2.115
datahub-0.2.116
datahub-0.2.117
datahub-0.2.118
datahub-0.2.119
datahub-0.2.12
datahub-0.2.120
datahub-0.2.121
datahub-0.2.122
datahub-0.2.125
datahub-0.2.126
datahub-0.2.127
datahub-0.2.128
datahub-0.2.129
datahub-0.2.13
datahub-0.2.130
datahub-0.2.131
datahub-0.2.132
datahub-0.2.133
datahub-0.2.134
datahub-0.2.135
datahub-0.2.136
datahub-0.2.137
datahub-0.2.138
datahub-0.2.139
datahub-0.2.14
datahub-0.2.140
datahub-0.2.141
datahub-0.2.142
datahub-0.2.143
datahub-0.2.144
datahub-0.2.145
datahub-0.2.146
datahub-0.2.147
datahub-0.2.148
datahub-0.2.149
datahub-0.2.15
datahub-0.2.150
datahub-0.2.151
datahub-0.2.152
datahub-0.2.153
datahub-0.2.154
datahub-0.2.155
datahub-0.2.156
datahub-0.2.157
datahub-0.2.158
datahub-0.2.159
datahub-0.2.16
datahub-0.2.160
datahub-0.2.161
datahub-0.2.162
datahub-0.2.163
datahub-0.2.164
datahub-0.2.165
datahub-0.2.166
datahub-0.2.167
datahub-0.2.168
datahub-0.2.169
datahub-0.2.17
datahub-0.2.170
datahub-0.2.171
datahub-0.2.172
datahub-0.2.173
datahub-0.2.174
datahub-0.2.175
datahub-0.2.176
datahub-0.2.177
datahub-0.2.178
datahub-0.2.179
datahub-0.2.18
datahub-0.2.180
datahub-0.2.181
datahub-0.2.19
datahub-0.2.2
datahub-0.2.20
datahub-0.2.21
datahub-0.2.22
datahub-0.2.23
datahub-0.2.24
datahub-0.2.25
datahub-0.2.26
datahub-0.2.27
datahub-0.2.28
datahub-0.2.29
datahub-0.2.3
datahub-0.2.30
datahub-0.2.31
datahub-0.2.32
datahub-0.2.33
datahub-0.2.34
datahub-0.2.35
datahub-0.2.36
datahub-0.2.37
datahub-0.2.38
datahub-0.2.39
datahub-0.2.4
datahub-0.2.40
datahub-0.2.41
datahub-0.2.42
datahub-0.2.43
datahub-0.2.44
datahub-0.2.45
datahub-0.2.46
datahub-0.2.47
datahub-0.2.48
datahub-0.2.49
datahub-0.2.5
datahub-0.2.50
datahub-0.2.51
datahub-0.2.52
datahub-0.2.53
datahub-0.2.54
datahub-0.2.55
datahub-0.2.56
datahub-0.2.57
datahub-0.2.58
datahub-0.2.59
datahub-0.2.6
datahub-0.2.60
datahub-0.2.61
datahub-0.2.62
datahub-0.2.63
datahub-0.2.64
datahub-0.2.65
datahub-0.2.66
datahub-0.2.67
datahub-0.2.68
datahub-0.2.69
datahub-0.2.7
datahub-0.2.70
datahub-0.2.71
datahub-0.2.72
datahub-0.2.73
datahub-0.2.74
datahub-0.2.75
datahub-0.2.76
datahub-0.2.77
datahub-0.2.78
datahub-0.2.79
datahub-0.2.8
datahub-0.2.80
datahub-0.2.81
datahub-0.2.82
datahub-0.2.83
datahub-0.2.84
datahub-0.2.85
datahub-0.2.86
datahub-0.2.87
datahub-0.2.88
datahub-0.2.89
datahub-0.2.9
datahub-0.2.90
datahub-0.2.91
datahub-0.2.92
datahub-0.2.93
datahub-0.2.94
datahub-0.2.95
datahub-0.2.96
datahub-0.2.97
datahub-0.2.98
datahub-0.2.99
datahub-prerequisites-0.*
datahub-prerequisites-0.0.1
datahub-prerequisites-0.0.10
datahub-prerequisites-0.0.11
datahub-prerequisites-0.0.12
datahub-prerequisites-0.0.13
datahub-prerequisites-0.0.14
datahub-prerequisites-0.0.15
datahub-prerequisites-0.0.16
datahub-prerequisites-0.0.17
datahub-prerequisites-0.0.18
datahub-prerequisites-0.0.2
datahub-prerequisites-0.0.3
datahub-prerequisites-0.0.4
datahub-prerequisites-0.0.5
datahub-prerequisites-0.0.6
datahub-prerequisites-0.0.8
datahub-prerequisites-0.0.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-29037.json"