PT-2022-24800 · Immudb · Immudb
Byopublished
·
Published
2022-11-21
·
Updated
2022-12-22
·
CVE-2022-39199
CVSS v3.1
5.8
Medium
| Vector | AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
immudb versions prior to 1.4.1
Description
immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use the server's UUID to distinguish between different server instances, allowing the client to connect to different immudb instances and keep the state for multiple servers. However, the SDK does not validate this UUID and can accept any value reported by the server. A malicious server can change the reported UUID, tricking the client into treating it as a different server and accepting a state completely irrelevant to the one previously retrieved from the server.
Recommendations
For versions prior to 1.4.1, update to version 1.4.1 to resolve the issue.
As a temporary workaround, when initializing an immudb client object, a custom state handler can be used to store the state, providing a custom implementation that ignores the server UUID to ensure the client considers the server as the same even if the UUID changes.
Exploit
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Immudb