GHSA-p3pf-mff8-3h47

Source

https://github.com/advisories/GHSA-p3pf-mff8-3h47

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/08/GHSA-p3pf-mff8-3h47/GHSA-p3pf-mff8-3h47.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p3pf-mff8-3h47

Aliases

CVE-2024-41270
GO-2024-3058

Published

2024-08-06T21:30:47Z

Modified

2024-08-19T17:58:40.669353Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Gorush uses deprecated TLS versions

Details

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.

Database specific

{
    "nvd_published_at": "2024-08-06T21:16:03Z",
    "cwe_ids": [
        "CWE-327"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-07T14:17:11Z"
}

References

Affected packages

Go / github.com/appleboy/gorush

Package

Name: github.com/appleboy/gorush; View open source insights on deps.dev
Purl: pkg:golang/github.com/appleboy/gorush

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.18.5