GitHub Advisoryadvisory · Go
GHSA-9v35-4xcr-w9ph NetBird uses a static initialization vector (IV)
HIGH
Official page ↗
- Aliases
- CVE-2024-41260
- Ecosystem
- Go
- Packages
- github.com/netbirdio/netbird
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-321
- Reviewed
- 2024-08-07
Affected packages
• Go github.com/netbirdio/netbird: >= 0.23.2, < 0.29.2 → fixed in 0.29.2
Description
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
Related
Alias · CVE (1)
- CVE-2024-41260 A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to… vulnerability
Weakness · CWE (1)
- CWE-321 Use of Hard-coded Cryptographic Key weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-41260 advisory
- https://github.com/netbirdio/netbird/issues/2246 web
- https://github.com/github/advisory-database/pull/5714 web
- https://github.com/netbirdio/netbird/pull/2569 web
- https://github.com/netbirdio/netbird/commit/cf6210a6f42355e88c422c624376f6fcdaea6729 web
- https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636 web
- https://github.com/advisories/GHSA-9v35-4xcr-w9ph advisory
- https://github.com/netbirdio/netbird package