CVE-2023-47640

Insecure Use of HMAC-SHA1 For Session Signing in datahub

Description

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources (i.e. state level actors with large computational capabilities). DataHub Frontend was utilizing the Play LegacyCookiesModule with default settings which utilizes a SHA1 HMAC for signing. This is compounded by using a shorter key length than recommended by default for the signing key for the randomized secret value. An authenticated attacker (or attacker who has otherwise obtained a session token) could crack the signing key for DataHub and obtain escalated privileges by generating a privileged session cookie. Due to key length being a part of the risk, deployments should update to the latest helm chart and rotate their session signing secret. All deployments using the default helm chart configurations for generating the Play secret key used for signing are affected by this vulnerability. Version 0.11.1 resolves this vulnerability. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Category

6.4
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.05%
Third-Party Advisory github.com
Affected: datahub-project datahub
Published at:
Updated at:

References

Link Tags
https://github.com/datahub-project/datahub/security/advisories/GHSA-fg9x-wvqw-6gmw third party advisory

Frequently Asked Questions

What is the severity of CVE-2023-47640?
CVE-2023-47640 has been scored as a medium severity vulnerability.
How to fix CVE-2023-47640?
To fix CVE-2023-47640, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-47640 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2023-47640 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-47640?
CVE-2023-47640 affects datahub-project datahub.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.