SCA: security update for lemur (GHSA-q437-g7fv-2jvv)

medium Tenable Cloud Security Plugin ID 443981

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement
password directly to users.password, while lemur/users/models.py registered User.hash_password only for
the before_insert event. Because no before_update listener ran, administrator-initiated password changes
through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate
normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log,
or administrative read compromise exposed immediately usable credentials without offline cracking. The fix
registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This
issue is fixed in version 1.9.2. (CVE-2026-55164)

Solution

Update the lemur library and its related packages to version 1.9.2 or later.

Plugin Details

Severity: Medium

ID: 443981

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/26/2026

Updated: 8/19/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.71

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:N/A:N

CVSS Score Source: CVE-2026-55164

CVSS v3

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/25/2026

Vulnerability Publication Date: 6/25/2026

Reference Information

CVE: CVE-2026-55164

cwe: CWE-256

Detections

Analytics