-
Notifications
You must be signed in to change notification settings - Fork 503
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[CVE-2019-1010260] [SECURITY] Resolve dependenices over HTTPS instead of HTTP #332
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Grammar
Co-Authored-By: JLLeitschuh <jonathan.leitschuh@gmail.com>
Thanks @SamCarlberg! |
🙇 |
CVE has been filed for: |
This has been given a CVE number: CVE-2019-1000034 |
Hi @pinterest, Do you want me to re-submit for the CVE number or is Pintrest a CNA? |
Pinterest is not a CNA so feel free to resubmit. |
We have a reserved CVE for this vulnerability. Details should be posted there shortly (hopefully). It seems with the DWF (Distributed Weakness Filing) having been shut down, it seems that MITRE has a bit of a backlog to chew through. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010260 |
Before this change, all the repositories that have been used to resolve rulesets have downloaded those rulesets over HTTP instead of HTTPS. This leaves the user wide open to system compromise via a Man In The Middle (MITM) attack. This isn't just theoretical; POC code exists already.
See:
I will file for a CVE number after this is merged and a release has been published.
This vulnerability has a CVSS v3.0 Base Score of 8.1
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H