CVE-2023-1712: Use of hard-coded, security-relevant constants in deepset-ai/haystack
9.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.50782%
CWE
Published
3/30/2023
Updated
4/6/2023
KEV Status
No
Technology
Python
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| farm-haystack | pip | <= 1.15.0 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from hard-coded security constants in environment variable definitions within configuration files (docker-compose.yml and README.md), not from specific code functions. The commit diff shows hard-coded credentials/secrets like DEFAULT_ADMIN_PASSWORD, PROD_DB_PASSWORD, COOKIE_KEYS, and JWT_SECRET being defined with insecure default values. These are configuration-level issues rather than function-level vulnerabilities. The patch addresses this by removing hard-coded values and adding security warnings, but there's no evidence of vulnerable application logic functions in the provided code diffs or descriptions.