Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tcHZ4LXdocHAtOTl4as4AA-TO

Filestash skips TLS certificate verification process when sending out email verification codes

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack.

Permalink: https://github.com/advisories/GHSA-mpvx-whpp-99xj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tcHZ4LXdocHAtOTl4as4AA-TO
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 months ago
Updated: about 1 month ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-mpvx-whpp-99xj, CVE-2024-41256
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-41256
• https://gist.github.com/nyxfqq/a6da3fe6128b978ea1aaa5df639d5f98
• https://github.com/mickael-kerjean/filestash/issues/709
• https://github.com/mickael-kerjean/filestash/blob/master/server/model/share.go#L132
• https://pkg.go.dev/vuln/GO-2024-3035
• https://github.com/advisories/GHSA-mpvx-whpp-99xj

Repository: https://github.com/mickael-kerjean/filestash
Blast Radius: 0.0

Affected Packages