GHSA-j3rq-4xjw-xg63

Source

https://github.com/advisories/GHSA-j3rq-4xjw-xg63

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-j3rq-4xjw-xg63/GHSA-j3rq-4xjw-xg63.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-j3rq-4xjw-xg63

Aliases

GO-2023-2378

Published

2023-12-04T23:13:42Z

Modified

2024-08-21T14:57:43.653467Z

Summary

Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks

Details

Impact

Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.

Patches

The issue has been patched in v1.4.0

Workarounds

Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-300"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-12-04T23:13:42Z"
}

References

Affected packages

Go / github.com/edgelesssys/marblerun

Package

Name: github.com/edgelesssys/marblerun; View open source insights on deps.dev
Purl: pkg:golang/github.com/edgelesssys/marblerun

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.4.0