GitHub Advisoryadvisory · Go

GHSA-j3rq-4xjw-xg63 Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks

HIGH Published 2023-12-04 Modified 2023-12-04 Official page ↗
Ecosystem
Go
Packages
github.com/edgelesssys/marblerun
Severity
High
Weaknesses
CWE-300
Reviewed
2023-12-04

Affected packages

• Go github.com/edgelesssys/marblerun: < 1.4.0 → fixed in 1.4.0

Description

Impact Any CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest. Patches The issue has been patched in `v1.4.0` Workarounds Directly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.

Related

Weakness · CWE (1)

  • CWE-300 Channel Accessible by Non-Endpoint weakness

References