| modules: |
| - module: github.com/codenotary/immudb |
| versions: |
| - fixed: 1.4.1 |
| vulnerable_at: 1.4.0 |
| packages: |
| - package: github.com/codenotary/immudb/pkg/client/auditor |
| symbols: |
| - defaultAuditor.audit |
| derived_symbols: |
| - defaultAuditor.Run |
| - package: github.com/codenotary/immudb/pkg/client |
| symbols: |
| - immuClient.verifiedGet |
| - immuClient.VerifiedSet |
| - immuClient.VerifiedTxByID |
| - immuClient.VerifiedSetReferenceAt |
| - immuClient.VerifiedZAddAt |
| - immuClient.VerifyRow |
| - immuClient._streamVerifiedSet |
| - immuClient._streamVerifiedGet |
| derived_symbols: |
| - immuClient.SafeGet |
| - immuClient.SafeReference |
| - immuClient.SafeSet |
| - immuClient.SafeZAdd |
| - immuClient.StreamVerifiedGet |
| - immuClient.StreamVerifiedSet |
| - immuClient.VerifiedGet |
| - immuClient.VerifiedGetAt |
| - immuClient.VerifiedGetAtRevision |
| - immuClient.VerifiedGetSince |
| - immuClient.VerifiedSetReference |
| - immuClient.VerifiedZAdd |
| - package: github.com/codenotary/immudb/embedded/store |
| symbols: |
| - ImmuStore.DualProof |
| - VerifyLinearProof |
| - VerifyDualProof |
| description: | |
| In certain scenarios, a malicious immudb server can provide a |
| falsified proof that will be accepted by the client SDK signing a |
| falsified transaction replacing the genuine one. This situation can |
| not be triggered by a genuine immudb server and requires the client to |
| perform a specific list of verified operations resulting in acceptance |
| of an invalid state value. |
| |
| This vulnerability only affects immudb client SDKs, the immudb server |
| itself is not affected by this vulnerability. |
| cves: |
| - CVE-2022-36111 |
| ghsas: |
| - GHSA-672p-m5jq-mrh8 |
| references: |
| - advisory: https://github.com/codenotary/immudb/security/advisories/GHSA-672p-m5jq-mrh8 |
| - article: https://github.com/codenotary/immudb/tree/master/docs/security/vulnerabilities/linear-fake |
| - fix: https://github.com/codenotary/immudb/commit/acf7f1b3d62436ea5e038acea1fc6394f90ab1c6 |
| - fix: https://github.com/codenotary/immudb/commit/7267d67e28be8f0257b71d734611a051593e8a81 |
