GitHub Advisoryadvisory · Go

GHSA-6rrw-4fm9-rghv Use of Hard-coded Cryptographic Key in Netmaker

HIGH Published 2022-02-19 Modified 2022-02-23 Official page ↗

Aliases: CVE-2022-0664
Ecosystem: Go
Packages: github.com/gravitl/netmaker
Severity: High
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-321
Reviewed: 2022-02-23

Affected packages

• Go github.com/gravitl/netmaker: < 0.8.5 → fixed in 0.8.5 • Go github.com/gravitl/netmaker: >= 0.9.0, < 0.9.4 → fixed in 0.9.4

Description

Netmaker prior to versions 0.8.5, 0.9.4, 0.10.0, and 0.10.1 uses a hard-coded cryptographic key.

Related

Alias · CVE (1)

CVE-2022-0664 Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1. vulnerability

Weakness · CWE (1)

CWE-321 Use of Hard-coded Cryptographic Key weakness

References