PT-2019-20026 · Redbird · Redbird

Publicado 2019-06-06 · Atualizado 2019-06-06

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions redbird versions prior to 0.9.1

Description The issue is related to a vulnerable default configuration that allows TLS 1.0 connections on the lib/proxy.js file. TLS 1.0 is deprecated and vulnerable. The package does not provide an option to disable TLS 1.0.

Recommendations Upgrade to version 0.9.1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

GHSA-8948-FFC6-JG52

Produtos afetados

Redbird

Referências · 5

• https://github.com/OptimalBits/redbird/pull/207 · Nota
• https://github.com/OptimalBits/redbird/commit/39c7a2da84a2ddddfe046ea80e98800518920516 · Nota
• https://npmjs.com/advisories/828 · Nota
• https://osv.dev/vulnerability/GHSA-8948-ffc6-jg52 · Aviso do Fabricante
• https://snyk.io/vuln/SNYK-JS-REDBIRD-174455 · Nota