PT-2024-26940 · Apache · Apache Submarine Commons Utils

Jonathan Leitschuh + 1 · Published 2024-06-12 · Updated 2024-10-15 · CVE-2024-36264

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Submarine Commons Utils versions 0.8.0 and later

Description The issue is related to an Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set submarine.auth.default.secret, a default value will be used. This vulnerability only affects products that are no longer supported by the maintainer. As the project is retired, no fix will be released.

Recommendations For Apache Submarine Commons Utils versions 0.8.0 and later, users are recommended to find an alternative or restrict access to the instance to trusted users.

Fix

Improper Authentication

Using Hardcoded Credentials

Weakness Enumeration

CWE-287

CWE-798

Related Identifiers

CVE-2024-36264

GHSA-JWCG-WV5X-VG3G

PYSEC-2024-97

Affected Products

Apache Submarine Commons Utils

References · 17

• https://lists.apache.org/thread/7mo0c7vbhpo8thvybl8wwvb0bccrg7r4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-36264 · Security Note
• https://osv.dev/vulnerability/GHSA-jwcg-wv5x-vg3g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36264 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-97 · Vendor Advisory
• https://github.com/apache/submarine/pull/1125 · Vendor Advisory, Patch
• https://github.com/apache/submarine · Note
• https://github.com/apache/submarine/commit/7a1d551798c6785fc68fe028fc46f74c3ee6976d · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-submarine/PYSEC-2024-97.yaml · Note
• https://t.me/cvenotify/88441 · Telegram Post
• https://t.me/cvenotify/83010 · Telegram Post
• https://t.me/cvenotify/83068 · Telegram Post
• http://openwall.com/lists/oss-security/2024/06/12/2 · Note
• https://issues.apache.org/jira/browse/SUBMARINE-1417 · Note
• https://t.me/cvenotify/97978 · Telegram Post