PT-2023-22986 · Netflix · Netflix Lemur
Published
2023-03-01
·
Updated
2025-11-21
·
CVE-2023-30797
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Netflix Lemur versions prior to 1.3.2
Description
The issue is related to Netflix Lemur using insufficiently random values when generating default credentials. This may allow an attacker to guess the credentials and gain access to resources managed by Lemur. The potentially affected generated items include configuration secrets such as
SECRET KEY, LEMUR TOKEN SECRET, LEMUR ENCRYPTION KEYS, OAUTH STATE TOKEN SECRET, and others. If a deployment of Lemur is using config secrets generated by Lemur's example config, it is recommended to rotate those config secrets.Recommendations
For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider rotating the config secrets that were generated using insecure randomness. For user passwords, one option for rotation would be to directly modify the value in the database to some other unguessable string.
Fix
Use of Insufficiently Random Values
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Netflix Lemur