HIGH 8.8

GHSA-q3cc-rr2c-87r6

Hex authenticity of signed packages not validated

Details

Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

Hex / hex_core

Introduced in: 0 Fixed in: 0.4.0

Fix mix deps.update hex_core

References

https://nvd.nist.gov/vuln/detail/CVE-2019-1000013 [ADVISORY]
https://github.com/hexpm/hex_core/pull/48 [WEB]
https://github.com/hexpm/hex_core/pull/51 [WEB]
https://github.com/hexpm/hex_core [PACKAGE]