Security Resilience

CVE-2023-22746

Crypto Weakness in Okfn Ckan ≤ 2.8.12

Crypto Weakness
Published
03 February 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 8.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS Score 0.0069 52th percentile
Risk Priority 65 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-22746 is a high-severity Use of Insufficiently Random Values (CWE-330) vulnerability in Okfn Ckan. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 48% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. When creating a new container based on one of the Docker images listed below, the same secret key was being used by default. If the…

more

users didn't set a custom value via environment variables in the `.env` file, that key was shared across different CKAN instances, making it easy to forge authentication requests. Users overriding the default secret key in their own `.env` file are not affected by this issue. Note that the legacy images (ckan/ckan) located in the main CKAN repo are not affected by this issue. The affected images are ckan/ckan-docker, (ckan/ckan-base images), okfn/docker-ckan (openknowledge/ckan-base and openknowledge/ckan-dev images) keitaroinc/docker-ckan (keitaro/ckan images).

CWE(s)
CWE-330CWE-344

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001 Data Obfuscation Command And Control
Adversaries may obfuscate command and control traffic to make it more difficult to detect.
attack.mitre.org →
T1006 Direct Volume Access Stealth
Adversaries may directly access a volume to bypass file access controls and file system monitoring.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
T1011.001 Exfiltration Over Bluetooth Exfiltration
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.
attack.mitre.org →
T1016 System Network Configuration Discovery Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.
attack.mitre.org →
T1018 Remote System Discovery Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-27097Same product: Okfn Ckan
CVE-2026-41255Same product: Okfn Ckan
CVE-2023-50248Same product: Okfn Ckan
CVE-2024-43371Same product: Okfn Ckan
CVE-2024-41674Same product: Okfn Ckan
CVE-2026-42032Same product: Okfn Ckan
CVE-2026-42031Same product: Okfn Ckan
CVE-2023-32696Same product: Okfn Ckan
CVE-2023-32321Same product: Okfn Ckan
CVE-2024-41675Same product: Okfn Ckan

Affected Assets

okfn
ckan
≤ 2.8.12 · 2.9.0 — 2.9.7

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V7.2.2

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-12 Cryptographic Key Establishment and Management
addresses: CWE-330

Key generation under controlled management uses approved random-bit sources rather than insufficiently random values.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 partial match
blocks

Configuration management directly requires replacing hard-coded invariants with environment-specific settings.

PR.PS-06 partial match
blocks

Secure SDLC practices include avoiding invariant values that break across environments.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.23 Information security for use of cloud services partial match
removes
A.8.19 Installation of software on operational systems partial match
removes
A.8.24 Use of cryptography partial match
blocks

Cryptographic controls require use of approved, sufficiently random values for keys and nonces.

A.8.25 Secure development life cycle partial match
blocks

Secure SDLC processes include verification steps that can catch insufficient randomness but do not directly specify RNG requirements.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including those that could address environment-specific values) be identified and specified during development or acquisition; it does not itself enforce, implement, or stop exploitation of an invariant value used in a changing context.

A.8.27 Secure system architecture and engineering principles partial match
blocks

Secure architecture principles discourage hard-coded assumptions, yet the control is broader than this single weakness.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

References