GHSA-vfxc-r2gx-v2vq

Source

https://github.com/advisories/GHSA-vfxc-r2gx-v2vq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vfxc-r2gx-v2vq/GHSA-vfxc-r2gx-v2vq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vfxc-r2gx-v2vq

Aliases

Published

2022-05-24T16:46:55Z

Modified

2023-11-08T04:01:05Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Hybrid Group Gobot Improper Certificate Validation vulnerability

Details

An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.

Specific Go Packages Affected

github.com/hybridgroup/gobot/platforms/mqtt

Database specific

{
    "cwe_ids":  [
        "CWE-295"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-02-08T00:25:02Z",
    "nvd_published_at":  "2019-05-31T11:29:00Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/hybridgroup/gobot

Package

Name: github.com/hybridgroup/gobot; View open source insights on deps.dev
Purl: pkg:golang/github.com/hybridgroup/gobot

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.12.1-0.20190521122906-c1aa4f867846

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vfxc-r2gx-v2vq/GHSA-vfxc-r2gx-v2vq.json"