Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS12dzdnLTNjYzctN3JtaM4AA-Uh
cortex establishes TLS connections with `InsecureSkipVerify` set to `true`
A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
Permalink: https://github.com/advisories/GHSA-vw7g-3cc7-7rmhJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12dzdnLTNjYzctN3JtaM4AA-Uh
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 4 months ago
Updated: 4 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-vw7g-3cc7-7rmh, CVE-2024-41265
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-41265
- https://gist.github.com/nyxfqq/1a8237f3f9cf793c6433f08b17d1593c
- https://pkg.go.dev/vuln/GO-2024-3036
- https://github.com/advisories/GHSA-vw7g-3cc7-7rmh
Affected Packages
go:github.com/cortexproject/cortex
Dependent packages: 213Dependent repositories: 601
Downloads:
Affected Version Ranges: <= 0.42.1
No known fixed version
All affected versions: 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.6.0, 0.6.1, 0.7.0