| modules: |
| - module: github.com/codenotary/immudb |
| versions: |
| - fixed: 1.4.1 |
| vulnerable_at: 1.4.0 |
| packages: |
| - package: github.com/codenotary/immudb/pkg/client |
| symbols: |
| - NewImmuClient |
| - DefaultOptions |
| - immuClient.OpenSession |
| derived_symbols: |
| - NewClient |
| description: | |
| A malicious server can trick a client into treating it as a different |
| server by changing the reported UUID. |
| |
| immudb client SDKs use the server's UUID to distinguish between different |
| server instance so that the client can connect to different immudb |
| instances and keep the state for multiple servers. The SDK does not |
| validate this UUID and accepts any value reported by the server. A |
| malicious server can therefore change the reported UUID and trick the |
| client into treating it as a different server. |
| cves: |
| - CVE-2022-39199 |
| ghsas: |
| - GHSA-6cqj-6969-p57x |
| references: |
| - advisory: https://github.com/codenotary/immudb/security/advisories/GHSA-6cqj-6969-p57x |
| - fix: https://github.com/codenotary/immudb/commit/cade04756ff3f0a3b9e8d24149062744574adf5d |
