GHSA-4jmm-c6jw-g796

Source

https://github.com/advisories/GHSA-4jmm-c6jw-g796

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-4jmm-c6jw-g796/GHSA-4jmm-c6jw-g796.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4jmm-c6jw-g796

Aliases

Published

2024-07-31T21:32:38Z

Modified

2024-09-06T21:37:51Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Filestash configured to skip TLS certificate verification when using the FTPS protocol

Details

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.

Database specific

{
    "nvd_published_at": "2024-07-31T21:15:18Z",
    "cwe_ids": [
        "CWE-295",
        "CWE-453"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-02T16:27:35Z"
}

References

Affected packages

Go / github.com/mickael-kerjean/filestash

Package

Name: github.com/mickael-kerjean/filestash; View open source insights on deps.dev
Purl: pkg:golang/github.com/mickael-kerjean/filestash

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-4jmm-c6jw-g796/GHSA-4jmm-c6jw-g796.json"