PT-2023-30684 · Unknown · Localstack

Published 2023-11-16 · Updated 2023-11-22 · CVE-2023-48054

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions localstack version 2.3.2

Description The issue is related to missing SSL certificate validation, which allows attackers to intercept communications between the host and server through a man-in-the-middle attack. This enables attackers to eavesdrop on the communication.

Recommendations For localstack version 2.3.2, update to a version that includes SSL certificate validation to prevent man-in-the-middle attacks. As a temporary workaround, consider disabling communication between the host and server until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2023-48054

GHSA-8633-G3PH-97RP

PYSEC-2023-243

Affected Products

Localstack

References · 8

• https://osv.dev/vulnerability/PYSEC-2023-243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48054 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48054 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8633-g3ph-97rp · Vendor Advisory
• https://github.com/localstack/localstack · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/localstack/PYSEC-2023-243.yaml · Note
• https://gxx777.github.io/localstack_v_2.3.2_Cryptographic_API_Misuse_Vulnerability.md · Note
• https://t.me/cvenotify/61038 · Telegram Post