160 lines
6.9 KiB
JSON
160 lines
6.9 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2024-48915",
|
||
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "GitHub_M",
|
||
"dateReserved": "2024-10-09T22:06:46.172Z",
|
||
"datePublished": "2024-10-15T17:12:31.400Z",
|
||
"dateUpdated": "2024-11-21T16:53:44.140Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"title": "Agent Dart missing certificate verification checks",
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-295",
|
||
"lang": "en",
|
||
"description": "CWE-295: Improper Certificate Validation",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"attackVector": "NETWORK",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "NONE",
|
||
"privilegesRequired": "NONE",
|
||
"userInteraction": "NONE",
|
||
"vulnConfidentialityImpact": "NONE",
|
||
"vulnIntegrityImpact": "HIGH",
|
||
"vulnAvailabilityImpact": "NONE",
|
||
"subConfidentialityImpact": "NONE",
|
||
"subIntegrityImpact": "NONE",
|
||
"subAvailabilityImpact": "NONE",
|
||
"baseScore": 8.7,
|
||
"baseSeverity": "HIGH",
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
|
||
"version": "4.0"
|
||
}
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"name": "https://github.com/AstroxNetwork/agent_dart/security/advisories/GHSA-fmj7-7gfw-64pg",
|
||
"tags": [
|
||
"x_refsource_CONFIRM"
|
||
],
|
||
"url": "https://github.com/AstroxNetwork/agent_dart/security/advisories/GHSA-fmj7-7gfw-64pg"
|
||
},
|
||
{
|
||
"name": "https://github.com/AstroxNetwork/agent_dart/commit/0d200686aabcd9313c7bc3e675cbdc82f6b775cf",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/AstroxNetwork/agent_dart/commit/0d200686aabcd9313c7bc3e675cbdc82f6b775cf"
|
||
},
|
||
{
|
||
"name": "https://github.com/AstroxNetwork/agent_dart/blob/f50971dfae3f536c1720f0084f28afbcf5d99cb5/lib/agent/certificate.dart#L162",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/AstroxNetwork/agent_dart/blob/f50971dfae3f536c1720f0084f28afbcf5d99cb5/lib/agent/certificate.dart#L162"
|
||
},
|
||
{
|
||
"name": "https://github.com/AstroxNetwork/agent_dart/blob/main/lib/agent/certificate.dart",
|
||
"tags": [
|
||
"x_refsource_MISC"
|
||
],
|
||
"url": "https://github.com/AstroxNetwork/agent_dart/blob/main/lib/agent/certificate.dart"
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "AstroxNetwork",
|
||
"product": "agent_dart",
|
||
"versions": [
|
||
{
|
||
"version": "< 1.0.0-dev.29",
|
||
"status": "affected"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
||
"shortName": "GitHub_M",
|
||
"dateUpdated": "2024-10-15T17:12:31.400Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Agent Dart is an agent library built for Internet Computer for Dart and Flutter apps. Prior to version 1.0.0-dev.29, certificate verification in `lib/agent/certificate.dart` does not occur properly. During the delegation verification in the `_checkDelegation` function, the canister_ranges aren't verified. The impact of not checking the canister_ranges is that a subnet can sign canister responses in behalf of another subnet. The certificate’s timestamp, i.e /time path, is also not verified, meaning that the certificate effectively has no expiration time. Version 1.0.0-dev.29 implements appropriate certificate verification."
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "GHSA-fmj7-7gfw-64pg",
|
||
"discovery": "UNKNOWN"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"affected": [
|
||
{
|
||
"vendor": "astroxnetwork",
|
||
"product": "agent_dart",
|
||
"cpes": [
|
||
"cpe:2.3:a:astroxnetwork:agent_dart:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unknown",
|
||
"versions": [
|
||
{
|
||
"version": "0",
|
||
"status": "affected",
|
||
"lessThan": "1.0.0-dev.29",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-10-15T18:52:37.058890Z",
|
||
"id": "CVE-2024-48915",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-11-21T16:53:44.140Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |