CVE-2022-39238

    Dashboard / Vulnerabilities / CVE-2022-39238

    CVE-2022-39238

    Published: 23 Sept 2022Last Modified: 12 Aug 2026

    Summary: Improper Authentication in Arvados when using PAM as identity provider

    Details: Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM) for user authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host (such as an expired password), it would still be accepted for access to Arvados. Other authentication methods (LDAP, OpenID Connect) supported by Arvados are not affected by this flaw. This issue is patched in version 2.4.3. Workaround for this issue is to migrate to a different authentication method supported by Arvados, such as LDAP.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39238.json, https://github.com/arvados/arvados/security/advisories/GHSA-87jr-xwhg-cxjv, https://nvd.nist.gov/vuln/detail/CVE-2022-39238

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1adc1e6b8ae357992d39c6b6bc1bc16192a94d9c

    Affected versions

    2.4.1
    2.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39238 | CVE-DB