PT-2019-11265 · Hex · Hex Core

Publicado 2019-02-04 · Atualizado 2022-05-13 · CVE-2019-1000013

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: hex core versions 0.3.0 and earlier

Description: The issue concerns a Signing oracle vulnerability in Package registry verification, which can lead to package modifications not being detected. This allows for code execution when a victim fetches packages from a malicious or compromised mirror.

Recommendations: For hex core versions 0.3.0 and earlier, update to version 0.4.0 to resolve the issue.

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2019-1000013

GHSA-Q3CC-RR2C-87R6

Produtos afetados

Hex Core

Referências · 6

• https://github.com/hexpm/hex_core · Nota
• https://github.com/hexpm/hex_core/pull/51 · Correção
• https://github.com/hexpm/hex_core/pull/48 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000013 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-q3cc-rr2c-87r6 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1000013 · Aviso do Fabricante