| id: GO-2025-3648 |
| modules: |
| - module: github.com/rancher/steve |
| non_go_versions: |
| - introduced: 0.3.0 |
| - fixed: 0.3.3 |
| - module: github.com/rancher/steve |
| versions: |
| - introduced: 0.2.0 |
| - fixed: 0.2.1 |
| - introduced: 0.4.0 |
| - fixed: 0.4.4 |
| - introduced: 0.5.0 |
| - fixed: 0.5.13 |
| vulnerable_at: 0.5.12 |
| summary: |- |
| Steve doesn’t verify a server’s certificate and is susceptible to |
| man-in-the-middle (MitM) attacks in github.com/rancher/stev |
| cves: |
| - CVE-2023-32198 |
| ghsas: |
| - GHSA-95fc-g4gj-mqmx |
| references: |
| - advisory: https://github.com/rancher/steve/security/advisories/GHSA-95fc-g4gj-mqmx |
| source: |
| id: GHSA-95fc-g4gj-mqmx |
| created: 2025-04-29T12:46:44.848556-04:00 |
| review_status: UNREVIEWED |
