PT-2019-20026 · Redbird · Redbird

Published 2019-06-06 · Updated 2019-06-06

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions redbird versions prior to 0.9.1

Description The issue is related to a vulnerable default configuration that allows TLS 1.0 connections on the lib/proxy.js file. TLS 1.0 is deprecated and vulnerable. The package does not provide an option to disable TLS 1.0.

Recommendations Upgrade to version 0.9.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-8948-FFC6-JG52

Affected Products

Redbird

References · 5

• https://osv.dev/vulnerability/GHSA-8948-ffc6-jg52 · Vendor Advisory
• https://github.com/OptimalBits/redbird/pull/207 · Note
• https://github.com/OptimalBits/redbird/commit/39c7a2da84a2ddddfe046ea80e98800518920516 · Note
• https://npmjs.com/advisories/828 · Note
• https://snyk.io/vuln/SNYK-JS-REDBIRD-174455 · Note