PT-2018-3094 · Hex · Hex

Publicado 2018-12-20 · Atualizado 2021-07-21 · CVE-2019-1000012

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hex package manager versions 0.14.0 through 0.18.2

Description The issue is related to insufficient input validation in the Hex package manager, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved by loading packages from a malicious mirror site. The exploitation may result in undetected package modifications, allowing code execution.

Recommendations For Hex package manager versions 0.14.0 through 0.18.2, update to version 0.19 or later to resolve the issue. As a temporary workaround, consider restricting access to packages from untrusted or compromised mirror sites to minimize the risk of exploitation. Avoid using packages from malicious or unknown sources until the issue is resolved.

Correção

RCE

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-20

CWE-345

Identificadores relacionados

BDU:2019-03899

CVE-2019-1000012

Produtos afetados

Hex

Referências · 6

• https://github.com/hexpm/hex/pull/646 · Correção
• https://github.com/hexpm/hex/pull/651 · Correção
• https://osv.dev/vulnerability/CVE-2019-1000012 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000012 · Nota de Segurança
• https://oracle.com/security-alerts/bulletinjul2019.html · Nota
• https://bdu.fstec.ru/vul/2019-03899 · Nota de Segurança