Detections
Analytics

SCA: security update for lemur (GHSA-f3qq-49m6-rw8f)

medium Tenable Self-Hosted Container Security Plugin ID 446080

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in
 lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a
 different destination. The CRL requests.get call followed HTTP redirects without validating each Location
 target, so a public attacker-controlled URL could redirect to loopback, RFC1918, link-local, or instance-
 metadata addresses. Validation and connection also performed separate DNS resolutions, creating a time-of-
 check time-of-use window for DNS rebinding on both CRL and OCSP paths. An operator uploading a certificate
 through POST /api/1/certificates/upload could therefore induce blind internal requests despite the earlier
 mitigation. The fix disables redirects and pins validated addresses while preserving the correct Host
 value. This issue is fixed in version 1.9.3. (CVE-2026-70667)

Solution

Update the lemur library and its related packages to version 1.9.3 or later.

See Also

https://github.com/advisories/GHSA-f3qq-49m6-rw8f

Plugin Details

Severity: Medium

ID: 446080

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/19/2026

Updated: 8/19/2026

Risk Information

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2026-70667

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/18/2026

Vulnerability Publication Date: 8/18/2026

Reference Information

CVE: CVE-2026-70667