Описание
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
An authentication bypass vulnerability was found in InfluxDB. By default, when using JWT authentication, InfluxDB does not generate a signing secret or state in the documentation that a JWT secret must be generated. If InfluxDB is left in the default state, this flaw allows an attacker to generate their own JWT token and log into the InfluxDBinstance, potentially escalating privileges and gaining access to sensitive information.
Меры по смягчению последствий
For versions before 1.7.6, as per the documentation updated by influxdb, ensure that a default shared-secret has be defined when enabling JWT authentication: https://docs.influxdata.com/influxdb/v1.8/administration/authentication_and_authorization/#1-add-a-shared-secret-in-your-influxdb-configuration-file Versions including the fix will return an error if the secret is left empty.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Distributed Tracing Jaeger 1 | jaeger-rhel8-operator | Not affected | ||
| OpenShift Service Mesh 1 | servicemesh-prometheus | Not affected | ||
| OpenShift Service Mesh 2.0 | servicemesh-prometheus | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | influxdb | Not affected | ||
| Red Hat Fuse 7 | camel-influxdb | Not affected | ||
| Red Hat Fuse 7 | camel-influxdb-starter | Not affected | ||
| Red Hat Fuse 7 | influxdb-java | Not affected | ||
| Red Hat Integration Camel K 1 | camel-influxdb | Not affected | ||
| Red Hat Integration Camel K 1 | camel-quarkus-influxdb-deployment | Not affected | ||
| Red Hat Integration Camel K 1 | camel-quarkus-influxdb-integration-test | Not affected |
Показывать по
Дополнительная информация
Статус:
8.6 High
CVSS3
Связанные уязвимости
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
InfluxDB before 1.7.6 has an authentication bypass vulnerability in th ...
Уязвимость функции authenticate компонента services/httpd/handler.go базы данных временных рядов InfluxDB, связанная с недостатками процедуры аутентификации, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
8.6 High
CVSS3