HIGH🇬🇧 English

CVE-2019-1000012

CVSS 8.8v3.0pub. 2019-02-04upd. 2024-11-21

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Hex

    APP
    Hex
    0.14.0 – 0.18.2
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2026-32148HIGH8.9ten sam produkt

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows ...

CVE-2026-21619LOW2.0ten sam produkt

Podatność Uncontrolled Resource Consumption oraz Deserialization of Untrusted Data w modułach hex_api bibliote...

CVE-2026-21622CRITICAL9.5PL ✓ten sam vendor

Brak wygasania tokenów resetowania hasła w Hex (hexpm) — przejęcie konta

CVE-2026-23940HIGH7.1ten sam vendor

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing a...

CVE-2026-21621HIGH7.0ten sam vendor

Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allo...