PT-2019-11265 · Hex · Hex Core

Published 2019-02-04 · Updated 2022-05-13 · CVE-2019-1000013

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: hex core versions 0.3.0 and earlier

Description: The issue concerns a Signing oracle vulnerability in Package registry verification, which can lead to package modifications not being detected. This allows for code execution when a victim fetches packages from a malicious or compromised mirror.

Recommendations: For hex core versions 0.3.0 and earlier, update to version 0.4.0 to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2019-1000013

GHSA-Q3CC-RR2C-87R6

Affected Products

Hex Core

References · 6

• https://github.com/hexpm/hex_core/pull/51 · Patch
• https://github.com/hexpm/hex_core/pull/48 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-1000013 · Security Note
• https://osv.dev/vulnerability/GHSA-q3cc-rr2c-87r6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1000013 · Vendor Advisory
• https://github.com/hexpm/hex_core · Note