PT-2022-23200 · Immudb · Immudb

Byop · Published 2022-11-21 · Updated 2022-12-22 · CVE-2022-36111

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions immudb versions prior to 1.4.1

Description immudb is a database with built-in cryptographic proof and verification. A malicious immudb server can provide a falsified proof that will be accepted by the client SDK, signing a falsified transaction and replacing the genuine one. This situation cannot be triggered by a genuine immudb server and requires the client to perform a specific list of verified operations, resulting in acceptance of an invalid state value. The vulnerability only affects immudb client SDKs, and the immudb server itself is not affected.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 to resolve the issue. As a temporary workaround, consider running a genuine immudb replica server in a safe environment and fully synchronizing all databases with the primary to ensure the server does not produce invalid proofs and to check that the history presented by the server does not contain falsified transactions.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2022-36111

GHSA-672P-M5JQ-MRH8

GO-2022-1117

Affected Products

Immudb

References · 16

• 🔥 https://github.com/codenotary/immudb/tree/master/docs/security/vulnerabilities/linear-fake · Exploit
• 🔥 https://github.com/codenotary/immudb/security/advisories/GHSA-672p-m5jq-mrh8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36111.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-36111 · Security Note
• https://osv.dev/vulnerability/GO-2022-1117 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-672p-m5jq-mrh8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36111 · Vendor Advisory
• https://github.com/codenotary/immudb · Note
• https://github.com/codenotary/immudb/releases/tag/v1.4.1 · Note
• https://github.com/codenotary/immudb/commit/acf7f1b3d62436ea5e038acea1fc6394f90ab1c6 · Note
• https://github.com/codenotary/immudb/commit/7267d67e28be8f0257b71d734611a051593e8a81 · Note
• https://pkg.go.dev/vuln/GO-2022-1117 · Note
• https://pkg.go.dev/github.com/codenotary/immudb/pkg/client · Note
• https://t.me/cibsecurity/53449 · Telegram Post
• https://t.me/cvenotify/38549 · Telegram Post