PT-2023-30684 · Unknown · Localstack

Publicado 2023-11-16 · Atualizado 2023-11-22 · CVE-2023-48054

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions localstack version 2.3.2

Description The issue is related to missing SSL certificate validation, which allows attackers to intercept communications between the host and server through a man-in-the-middle attack. This enables attackers to eavesdrop on the communication.

Recommendations For localstack version 2.3.2, update to a version that includes SSL certificate validation to prevent man-in-the-middle attacks. As a temporary workaround, consider disabling communication between the host and server until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2023-48054

GHSA-8633-G3PH-97RP

PYSEC-2023-243

Produtos afetados

Localstack

Referências · 8

• https://github.com/localstack/localstack · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/localstack/PYSEC-2023-243.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2023-243 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-48054 · Nota de Segurança
• https://gxx777.github.io/localstack_v_2.3.2_Cryptographic_API_Misuse_Vulnerability.md · Nota
• https://osv.dev/vulnerability/CVE-2023-48054 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-8633-g3ph-97rp · Aviso do Fabricante
• https://t.me/cvenotify/61038 · Publicação no Telegram