You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@submarine.apache.org by "laiyousin (via GitHub)" <gi...@apache.org> on 2024/03/20 03:41:09 UTC
[I] Hard-coded JWT Key Vulnerability [submarine]
laiyousin opened a new issue, #1120:
URL: https://github.com/apache/submarine/issues/1120
A hard-coded JWT (JSON Web Token) key vulnerability has been discovered, specifically within `org.apache.submarine.commons.utils.SubmarineConfVars.ConfVars#SUBMARINE_AUTH_DEFAULT_SECRET`, where the key is hardcoded as `SUBMARINE_SECRET_12345678901234567890`. It will pose a significant security risk by allowing attackers to generate unauthorized JWT tokens, potentially enabling them to bypass authentication mechanisms and access sensitive data and functionalities.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@submarine.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org