https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:30:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-337705 EUVD-2026-337705 https://cve.radiocsirt.org/vuln/euvd-2026-337705 https://cve.radiocsirt.org/vuln/fkie_cve-2023-30797 <p>Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.</p> <p>Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-30797 https://cve.radiocsirt.org/vuln/ghsa-5fqv-mpj8-h7gm <p><strong>Affected:</strong> PyPI: lemur</p> <p>### Overview Lemur was using insecure random generation for its example configuration file, as well as for some utilities.</p> <p>### Impact The potentially affected generated items include:</p> <p>| Configuration item | Config option name (if applicable) | Documentation link (if applicable) | Rotation option | Code reference(s) | | ----------- | ----------- | ----------- | ----------- |----------- | | Flask session secret | `SECRET_KEY` | [Flask documentation](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY) | Generate a new secret and place in config; all existing sessions will be invalidated | N/A, internal to Flask | | Lemur token secret | `LEMUR_TOKEN_SECRET` | [Lemur&#39;s configuration documentation](https://lemur.readthedocs.io/en/latest/administration.html#configuration) | Generate a new secret and place in config; all existing JWTs will be invalidated and must be regenerated (including API keys) | [1](https://github.com/Netflix/lemur/blob/1b61194a936240103f3c23299f9512c2b7e0fd36/lemur/auth/service.py#L79), [2](https://github.com/Netflix/lemur/blob/1b61194a936240103f3c23299f9512c2b7e0fd36/lemur/auth/service.py#L105) | | Lemur database encryption key | `LEMUR_ENCRYPTION_KEYS` | [Lemur&#39;s configuration documentation](https://lemur.readthedocs.io/en/latest/administration.html#configuration) | A new key can be generated and added to this list, but existing data encrypted with prior keys cannot be re-encrypted unless you write a custom re-encryption process…</p> <p><strong>Affected:</strong> PyPI: lemur</p> <p>### Overview Lemur was using insecure random generation for its example configuration file, as well as for some utilities.</p> <p>### Impact The potentially affected generated items include:</p> <p>| Configuration item | Config option name (if applicable) | Documentation link (if applicable) | Rotation option | Code reference(s) | | ----------- | ----------- | ----------- | ----------- |----------- | | Flask session secret | `SECRET_KEY` | [Flask documentation](https://flask.palletsprojects.com/en/2.2.x/config/#SECRET_KEY) | Generate a new secret and place in config; all existing sessions will be invalidated | N/A, internal to Flask | | Lemur token secret | `LEMUR_TOKEN_SECRET` | [Lemur&#39;s configuration documentation](https://lemur.readthedocs.io/en/latest/administration.html#configuration) | Generate a new secret and place in config; all existing JWTs will be invalidated and must be regenerated (including API keys) | [1](https://github.com/Netflix/lemur/blob/1b61194a936240103f3c23299f9512c2b7e0fd36/lemur/auth/service.py#L79), [2](https://github.com/Netflix/lemur/blob/1b61194a936240103f3c23299f9512c2b7e0fd36/lemur/auth/service.py#L105) | | Lemur database encryption key | `LEMUR_ENCRYPTION_KEYS` | [Lemur&#39;s configuration documentation](https://lemur.readthedocs.io/en/latest/administration.html#configuration) | A new key can be generated and added to this list, but existing data encrypted with prior keys cannot be re-encrypted unless you write a custom re-encryption process…</p> https://cve.radiocsirt.org/vuln/ghsa-5fqv-mpj8-h7gm https://cve.radiocsirt.org/vuln/gsd-2023-30797 gsd-2023-30797 https://cve.radiocsirt.org/vuln/gsd-2023-30797 https://cve.radiocsirt.org/vuln/pysec-2023-20 <p><strong>Affected:</strong> PyPI: lemur</p> <p>Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.</p> <p><strong>Affected:</strong> PyPI: lemur</p> <p>Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.</p> https://cve.radiocsirt.org/vuln/pysec-2023-20