CVE-2023-25561

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service JAAS authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any...

CVE-2023-25561 Login fail open on JAAS misconfiguration in DataHub

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service JAAS authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any...

CVE-2023-25561

CVE-2023-25561 affects DataHub. If JAAS authentication is used and the JAAS configuration has an error, authenticateJaasUser swallows the error, causing authentication to fail open and allowing unauthenticated logins with any username/password. Advisories from NVD/Red Hat/PRION note upgrading Dat...

CVE-2023-25561

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service JAAS authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any...

CVE-2023-25561 Login fail open on JAAS misconfiguration in DataHub

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service JAAS authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any...

CVE-2023-25561: Improper Handling of Exceptional Conditions

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service JAAS authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any...

GHSA-26F8-X7CC-WQPC Apache Kafka Connect vulnerable to Deserialization of Untrusted Data

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

Apache Kafka Connect vulnerable to Deserialization of Untrusted Data

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

CVE-2023-25194

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

CVE-2023-25194

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

CVE-2023-25194 Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

CVE-2023-25194 Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

CVE-2023-25194

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka...

CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtilsdoCreateDatasource use InitialContext.lookupjndiName without filtering. An us...

com.github.widebase:widebase-stream-handler-cq_2.9.1 (>=0.1.0, <=0.2.2), com.github.widebase:widebase-stream-handler-cq_2.9.2 (>=0.2.3, <=0.3.3) +180 more potentially affected by CVE-2015-6524 via org.apache.activemq:activemq-jaas (>=5.0.0, <=5.10.1)

org.apache.activemq:activemq-jaas MAVEN version =5.0.0, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =2.0.0, =2.3.3, =2.5.1 and more Source cves: CVE-2015-6524 Source advisory: GHSA-23CR-5HR4-RGWV...

com.github.widebase:widebase-stream-handler-cq_2.9.1 (>=0.1.0, <=0.2.2), com.github.widebase:widebase-stream-handler-cq_2.9.2 (>=0.2.3, <=0.3.3) +180 more potentially affected by CVE-2015-6524 via org.apache.activemq:activemq-jaas (>=5.0.0, <=5.10.1)

org.apache.activemq:activemq-jaas MAVEN version =5.0.0, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =2.0.0, =2.3.3, =2.5.1 and more Source cves: CVE-2015-6524 Source advisory: OSV:GHSA-23CR-5HR4-RGWV...

com.yubico.java:yubico-validation-client (2.0rc3), com.yubico:yubico-jaas-module (>=2.0rc4, <=3.1.0) +4 more potentially affected by CVE-2014-3607 via edu.vt.middleware:vt-ldap (>=3.3.2, <=3.3.5)

edu.vt.middleware:vt-ldap MAVEN version =3.3.2, =2.0rc4, =2.0.0, =2.2.0, =2.0.0, =2.3.0 Source cves: CVE-2014-3607 Source advisory: GHSA-273V-G3X4-R3RC...

com.yubico.java:yubico-validation-client (2.0rc3), com.yubico:yubico-jaas-module (>=2.0rc4, <=3.1.0) +4 more potentially affected by CVE-2014-3607 via edu.vt.middleware:vt-ldap (>=3.3.2, <=3.3.5)

edu.vt.middleware:vt-ldap MAVEN version =3.3.2, =2.0rc4, =2.0.0, =2.2.0, =2.0.0, =2.3.0 Source cves: CVE-2014-3607 Source advisory: OSV:GHSA-273V-G3X4-R3RC...

com.github.widebase:widebase-stream-handler-cq_2.9.1 (>=0.1.0, <=0.2.2), com.github.widebase:widebase-stream-handler-cq_2.9.2 (>=0.2.3, <=0.3.3) +180 more potentially affected by CVE-2014-3612 via org.apache.activemq:activemq-jaas (>=5.0.0, <=5.10.0)

org.apache.activemq:activemq-jaas MAVEN version =5.0.0, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =2.0.0, =2.3.3, =2.5.1 and more Source cves: CVE-2014-3612 Source advisory: OSV:GHSA-72M6-23FF-7Q26...

com.github.widebase:widebase-stream-handler-cq_2.9.1 (>=0.1.0, <=0.2.2), com.github.widebase:widebase-stream-handler-cq_2.9.2 (>=0.2.3, <=0.3.3) +180 more potentially affected by CVE-2014-3612 via org.apache.activemq:activemq-jaas (>=5.0.0, <=5.10.0)

org.apache.activemq:activemq-jaas MAVEN version =5.0.0, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =2.0.0, =2.3.3, =2.5.1 and more Source cves: CVE-2014-3612 Source advisory: GHSA-72M6-23FF-7Q26...