modules:
  - module: github.com/codenotary/immudb
    versions:
      - fixed: 1.4.1
    vulnerable_at: 1.4.0
    packages:
      - package: github.com/codenotary/immudb/pkg/client/auditor
        symbols:
          - defaultAuditor.audit
        derived_symbols:
          - defaultAuditor.Run
      - package: github.com/codenotary/immudb/pkg/client
        symbols:
          - immuClient.verifiedGet
          - immuClient.VerifiedSet
          - immuClient.VerifiedTxByID
          - immuClient.VerifiedSetReferenceAt
          - immuClient.VerifiedZAddAt
          - immuClient.VerifyRow
          - immuClient._streamVerifiedSet
          - immuClient._streamVerifiedGet
        derived_symbols:
          - immuClient.SafeGet
          - immuClient.SafeReference
          - immuClient.SafeSet
          - immuClient.SafeZAdd
          - immuClient.StreamVerifiedGet
          - immuClient.StreamVerifiedSet
          - immuClient.VerifiedGet
          - immuClient.VerifiedGetAt
          - immuClient.VerifiedGetAtRevision
          - immuClient.VerifiedGetSince
          - immuClient.VerifiedSetReference
          - immuClient.VerifiedZAdd
      - package: github.com/codenotary/immudb/embedded/store
        symbols:
          - ImmuStore.DualProof
          - VerifyLinearProof
          - VerifyDualProof
description: |
    In certain scenarios, a malicious immudb server can provide a
    falsified proof that will be accepted by the client SDK signing a
    falsified transaction replacing the genuine one. This situation can
    not be triggered by a genuine immudb server and requires the client to
    perform a specific list of verified operations resulting in acceptance
    of an invalid state value.

    This vulnerability only affects immudb client SDKs, the immudb server
    itself is not affected by this vulnerability.
cves:
  - CVE-2022-36111
ghsas:
  - GHSA-672p-m5jq-mrh8
references:
  - advisory: https://github.com/codenotary/immudb/security/advisories/GHSA-672p-m5jq-mrh8
  - article: https://github.com/codenotary/immudb/tree/master/docs/security/vulnerabilities/linear-fake
  - fix: https://github.com/codenotary/immudb/commit/acf7f1b3d62436ea5e038acea1fc6394f90ab1c6
  - fix: https://github.com/codenotary/immudb/commit/7267d67e28be8f0257b71d734611a051593e8a81