GHSA-4jmm-c6jw-g796

Suggest an improvement
Source
https://github.com/advisories/GHSA-4jmm-c6jw-g796
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-4jmm-c6jw-g796/GHSA-4jmm-c6jw-g796.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4jmm-c6jw-g796
Aliases
Published
2024-07-31T21:32:38Z
Modified
2024-09-06T21:37:51Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Filestash configured to skip TLS certificate verification when using the FTPS protocol
Details

filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.

References

Affected packages

Go / github.com/mickael-kerjean/filestash

Package

Name
github.com/mickael-kerjean/filestash
View open source insights on deps.dev
Purl
pkg:golang/github.com/mickael-kerjean/filestash

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.4