PT-2024-29335 · Filestash · Filestash

Bingyu Li · Published 2024-07-31 · Updated 2024-08-15 · CVE-2024-41258

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions filestash version 0.4

Description An issue was discovered where the usage of the ssh.InsecureIgnoreHostKey() function disables host key verification. This could possibly allow attackers to obtain sensitive information via a man-in-the-middle attack.

Recommendations For filestash version 0.4, consider disabling the use of ssh.InsecureIgnoreHostKey() to re-enable host key verification until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Improper Verification of Cryptographic Signature

Improper Certificate Validation

Weakness Enumeration

CWE-347

CWE-295

Related Identifiers

CVE-2024-41258

Affected Products

Filestash

References · 5

• https://osv.dev/vulnerability/CVE-2024-41258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41258 · Security Note
• https://t.me/cvedetector/2174 · Telegram Post
• https://gist.github.com/nyxfqq/ed8c2ba3398c9e28cd8dbf0902bd8edf · Note
• https://t.me/cvenotify/90748 · Telegram Post