CVE-2023-1712 (published 2023-03-30T10:15Z)

Use of Hard-coded, Security-relevant Constants in GitHub repository deepset-ai/haystack prior to 0.1.30.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-547
cwe_name: Use of Hard-coded, Security-relevant Constants
description: The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
extended_description: If the developer does not find all occurrences of the hard-coded constants, an incorrect policy decision may be made if one of the constants is not changed. Making changes to these values will require code changes that may be difficult or impossible once the system is released to the field. In addition, these hard-coded values may become available to attackers if the code is ever disclosed.
         

Fix information:
repo_url: https://github.com/deepset-ai/haystack
commit_details: repo_url: https://github.com/deepset-ai/haystack
author: oryx1729
author_date: 2023-03-29 12:54:21+02:00
msg: fix: update envs for the backend image of annotation tool (#4535)
repository: repo_url: https://github.com/deepset-ai/haystack
repo_name: deepset-ai/haystack
description: :mag: LLM orchestration framework to build customizable, production-ready LLM applications. Connect components (models, vector DBs, file converters) to pipelines or agents that can interact with your data. With advanced retrieval methods, it's best suited for building RAG, question answering, semantic search or conversational agent chatbots.
repo_language: Python
owner: deepset-ai
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -19,14 +19,17 @@ The credentials should match in database image and application configuration.
     DEFAULT_ADMIN_EMAIL: "example@example.com"
     DEFAULT_ADMIN_PASSWORD: "DEMO-PASSWORD"
 
-    PROD_DB_NAME: "databasename"
-    PROD_DB_USERNAME: "somesafeuser"
-    PROD_DB_PASSWORD: "somesafepassword"
-
+    DB_HOSTNAME: "db"
+    DB_NAME: "databasename"
+    DB_USERNAME: "somesafeuser"
+    DB_PASSWORD: "somesafepassword"
 
     POSTGRES_USER: "somesafeuser"
     POSTGRES_PASSWORD: "somesafepassword"
     POSTGRES_DB: "databasename"
+    
+    COOKIE_KEYS: "somesafecookiekeys"
+    JWT_SECRET: "somesafesecret"
 
 
 2. Run docker-compose by executing `docker-compose up`.

programming_language: Markdown
filename: docker-compose.yml
change_type: ModificationType.MODIFY
diff: @@ -3,13 +3,16 @@ services:
   backend:
     image: deepset/haystack-annotation:latest
     environment:
-      DEFAULT_ADMIN_EMAIL: "example@example.com"
-      DEFAULT_ADMIN_PASSWORD: "DEMO_PASSWORD"
       NODE_ENV: "production"
-      PROD_DB_HOSTNAME: "db"
-      PROD_DB_NAME: "databasename"
-      PROD_DB_USERNAME: "somesafeuser"
-      PROD_DB_PASSWORD: "somesafepassword"
+      DB_HOSTNAME: "db"
+      DB_NAME: "databasename"
+      DB_USERNAME: "somesafeuser"
+      DB_PASSWORD: "somesafepassword"
+      # IMPORTANT: please configure credentials with secure strings.
+      # DEFAULT_ADMIN_EMAIL: "example@example.com"
+      # DEFAULT_ADMIN_PASSWORD: "DEMO_PASSWORD"
+      # COOKIE_KEYS: "somesafecookiekeys"
+      # JWT_SECRET: "somesafesecret"
     ports:
       - "7001:7001"
     links:

programming_language: CoffeeScript