netbirdio/netbird · Security
NetBird uses a static initialization vector (IV)
- GHSA ID
- GHSA-9v35-4xcr-w9ph
- CVE ID
- CVE-2024-41260
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4
- 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
CWEs
- CWE-321 · Use of Hard-coded Cryptographic Key
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-41260 ↗
- https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636 ↗
- https://github.com/netbirdio/netbird/issues/2246 ↗
- https://github.com/advisories/GHSA-9v35-4xcr-w9ph ↗
- https://github.com/netbirdio/netbird/pull/2569 ↗
- https://github.com/netbirdio/netbird/commit/cf6210a6f42355e88c422c624376f6fcdaea6729 ↗
- https://github.com/github/advisory-database/pull/5714 ↗