{"affected":[{"affectedData":[{"product":"SSB-DB","vendor":"ssbc","versions":[{"status":"affected","version":"= 20.0.0"}]}],"source":"security-advisories@github.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:scuttlebutt:ssb-db:20.0.0:*:*:*:*:*:*:*","matchCriteriaId":"D8B56148-88F6-4EC0-BCFE-6909CD0105BD","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly ask it to, but there is a bug where it's decrypting any message that it can. This means that it is returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around get() to anonymous peers. This is fixed in version 20.0.1. Note that users of SSB-Server verion 16.0.0 should upgrade to 16.0.1 to get the fixed version of SSB-DB."},{"lang":"es","value":"SSB-DB versión 20.0.0, presenta una vulnerabilidad de divulgación de información. Se supone que el método get() solo descifra los mensajes cuando se le solicita explícitamente, pero se presenta un bug en el que descifra cualquier mensaje que pueda. Esto significa que está devolviendo el contenido descifrado de mensajes privados, que un peer malicioso podría usar para obtener acceso a datos privados. Esto solo afecta a los peers que ejecutan SSB-DB@20.0.0 que también tienen mensajes privados, y solo se sabe que es explotable si también está ejecutando SSB-OOO (predeterminado en SSB-Server), que expone un contenedor ligero alrededor de la función get( ) a compañeros anónimos. Esto se corrige en la versión 20.0.1. Tenga en cuenta que los usuarios de SSB-Server versión 16.0.0 deben actualizar a 16.0.1 para obtener la versión corregida de SSB-DB"}],"id":"CVE-2020-4045","lastModified":"2026-06-17T03:19:28.733","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"NONE","baseScore":5.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":10.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security-advisories@github.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-06-11T22:15:10.083","references":[{"source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/ssbc/ssb-db/commit/43334d0871c9cc6220e0f6d6338499060f7761d4"},{"source":"security-advisories@github.com","tags":["Third Party Advisory"],"url":"https://github.com/ssbc/ssb-db/security/advisories/GHSA-mpgr-2cx9-327h"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/ssbc/ssb-db/commit/43334d0871c9cc6220e0f6d6338499060f7761d4"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://github.com/ssbc/ssb-db/security/advisories/GHSA-mpgr-2cx9-327h"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-200"}],"source":"security-advisories@github.com","type":"Secondary"}]}