GHSA-4fpg-j5mp-783g
Cloudtoken Insufficiently Protects Credentials
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | cloudtoken | >= 0.1.1, < 0.1.24 | 0.1.24 |
Details
As written in the advisory (Markdown source, shown as plain text).
Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles.
References
External links from the advisory. They lead to third-party sites.