id: GO-2024-3058
modules:
    - module: github.com/appleboy/gorush
      versions:
        - fixed: 1.18.5
      vulnerable_at: 1.18.4
      packages:
        - package: github.com/appleboy/gorush/router
          symbols:
            - RunHTTPServer
summary: Gorush uses deprecated TLS versions in github.com/appleboy/gorush
description: |-
    An issue in the RunHTTPServer function in Gorush allows attackers to intercept
    and manipulate data due to the use of a deprecated TLS version.
cves:
    - CVE-2024-41270
ghsas:
    - GHSA-p3pf-mff8-3h47
references:
    - advisory: https://github.com/advisories/GHSA-p3pf-mff8-3h47
    - fix: https://github.com/appleboy/gorush/commit/067cb597e485e40b790a267187bf7f00730b1c4b
    - report: https://github.com/appleboy/gorush/issues/792
    - web: https://gist.github.com/nyxfqq/cfae38fada582a0f576d154be1aeb1fc
source:
    id: GHSA-p3pf-mff8-3h47
    created: 2024-08-16T17:25:03.501057-04:00
review_status: REVIEWED