GHSA-j3rq-4xjw-xg63

    Dashboard / Vulnerabilities / GHSA-j3rq-4xjw-xg63

    GHSA-j3rq-4xjw-xg63

    Published: 4 Dec 2023Last Modified: 21 Aug 2024
    Aliases:
    GO-2023-2378

    Summary: Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks

    Details: ### Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. ### Patches The issue has been patched in [`v1.4.0`](https://github.com/edgelesssys/marblerun/releases/tag/v1.4.0) ### Workarounds Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.

    References: https://github.com/edgelesssys/marblerun/security/advisories/GHSA-j3rq-4xjw-xg63, https://github.com/edgelesssys/marblerun, https://github.com/edgelesssys/marblerun/releases/tag/v1.4.0

    Affected packages

    Package

    Name: github.com/edgelesssys/marblerun

    Purl: pkg:golang/github.com/edgelesssys/marblerun

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.4.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-j3rq-4xjw-xg63 | CVE-DB