PT-2023-15684 · Palantir · Palantir Gotham Chat Irc Helper

Publicado 2023-02-16 · Atualizado 2023-02-27 · CVE-2022-48306

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Palantir Gotham Chat IRC helper versions prior to 30221005.210011.9242

Description The issue is related to improper validation of certificates with host mismatch, allowing a malicious attacker in a privileged network position to perform a man-in-the-middle attack. This could enable them to intercept, read, or modify network communications to and from the affected service.

Recommendations For versions prior to 30221005.210011.9242, update to a version that includes the fix for this issue to prevent man-in-the-middle attacks. As a temporary workaround, consider restricting network access to the Palantir Gotham Chat IRC helper until a patch is available.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-297

CWE-295

Identificadores relacionados

CVE-2022-48306

Produtos afetados

Palantir Gotham Chat Irc Helper

Referências · 4

• https://github.com/palantir/security-bulletins/blob/main/PLTRSEC-2022-09.md · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-48306 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-48306 · Nota de Segurança
• https://t.me/cibsecurity/58316 · Publicação no Telegram