Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1qM3JxLTR4ancteGc2M84AA3hy

Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks

Impact

Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.

Patches

The issue has been patched in v1.4.0

Workarounds

Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.

Permalink: https://github.com/advisories/GHSA-j3rq-4xjw-xg63
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qM3JxLTR4ancteGc2M84AA3hy
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 12 months ago
Updated: 12 months ago

Identifiers: GHSA-j3rq-4xjw-xg63
References:

• https://github.com/edgelesssys/marblerun/security/advisories/GHSA-j3rq-4xjw-xg63
• https://github.com/edgelesssys/marblerun/releases/tag/v1.4.0
• https://github.com/advisories/GHSA-j3rq-4xjw-xg63

Repository: https://github.com/edgelesssys/marblerun
Blast Radius: 0.0

Affected Packages