HIGH8.8

GHSA-q3cc-rr2c-87r6

Hex authenticity of signed packages not validated

Quick fix

GHSA-q3cc-rr2c-87r6 — hex_core: upgrade to the fixed version with the command below.

mix deps.update hex_core

Details

Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

Hex/hex_core

Introduced in: 0Fixed in: 0.4.0

Fixmix deps.update hex_core

References

https://nvd.nist.gov/vuln/detail/CVE-2019-1000013[ADVISORY]
https://github.com/hexpm/hex_core/pull/48[WEB]
https://github.com/hexpm/hex_core/pull/51[WEB]
https://github.com/hexpm/hex_core[PACKAGE]