PT-2024-2477 · Unknown · Datahub-Helm
Amit Laish
+1
·
Published
2024-03-20
·
Updated
2025-12-03
·
CVE-2024-29037
CVSS v3.1
9.4
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
datahub-helm versions 0.1.143 through 0.2.181
Description
The issue is related to the use of a default cryptographic key in the helm chart for deploying Datahub in a Kubernetes cluster. If there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during the window of releases. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized.
Recommendations
For versions 0.1.143 through 0.2.181, update to version 0.2.182 or later, which contains a patch for this issue.
As a temporary workaround, reset the token signing key to be a random value, which will invalidate active personal access tokens.
For deployments with Metadata Service Authentication enabled, ensure that secret values are properly randomized.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Datahub-Helm