GitHub Advisoryadvisory · Pub

GHSA-h6x7-r5rg-x5fw Serverpod client accepts any certificate

HIGH Published 2024-03-28 Modified 2024-03-28 Official page ↗
Aliases
CVE-2024-29887
Ecosystem
Pub
Packages
serverpod_client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2024-03-28

Affected packages

• Pub serverpod_client: < 1.2.6 → fixed in 1.2.6

Description

This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Impact All versions of `serverpod_client` pre `1.2.6` Patches Upgrading to version `1.2.6` resolves this issue.

Related

Alias · CVE (1)

  • CVE-2024-29887 Serverpod is an app and web server, built for the Flutter and Dart ecosystem. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References