PT-2018-3094 · Hex · Hex

Published 2018-12-20 · Updated 2021-07-21 · CVE-2019-1000012

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hex package manager versions 0.14.0 through 0.18.2

Description The issue is related to insufficient input validation in the Hex package manager, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved by loading packages from a malicious mirror site. The exploitation may result in undetected package modifications, allowing code execution.

Recommendations For Hex package manager versions 0.14.0 through 0.18.2, update to version 0.19 or later to resolve the issue. As a temporary workaround, consider restricting access to packages from untrusted or compromised mirror sites to minimize the risk of exploitation. Avoid using packages from malicious or unknown sources until the issue is resolved.

Fix

RCE

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-20

CWE-345

Related Identifiers

BDU:2019-03899

CVE-2019-1000012

Affected Products

Hex

References · 6

• https://github.com/hexpm/hex/pull/646 · Patch
• https://github.com/hexpm/hex/pull/651 · Patch
• https://osv.dev/vulnerability/CVE-2019-1000012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000012 · Security Note
• https://bdu.fstec.ru/vul/2019-03899 · Security Note
• https://oracle.com/security-alerts/bulletinjul2019.html · Note