CVE-2019-1000013
Last modified
CVE-2019-1000013 is a vulnerability of currently unknown severity. Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. EPSS estimates a 0.88% chance of exploitation in the next 30 days.
Description
Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hex | Hex Core | <= 0.3.0 |
References
- https://github.com/hexpm/hex_core/pull/48Patch, Third Party Advisory
- https://github.com/hexpm/hex_core/pull/51Patch, Third Party Advisory
- https://github.com/hexpm/hex_core/pull/48Patch, Third Party Advisory
- https://github.com/hexpm/hex_core/pull/51Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1000013?
How severe is CVE-2019-1000013?
How do I fix CVE-2019-1000013?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1000007aioxmpp version 0.10.2 and earlier contains a Improper Handl…
- CVE-2019-1000008All versions of Helm between Helm >=2.0.0 and < 2.12.2 conta…
- CVE-2019-1000009Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-…
- CVE-2019-1000010phpIPAM version 1.3.2 and earlier contains a Cross Site Scri…
- CVE-2019-1000011API Platform version from 2.2.0 to 2.3.5 contains an Incorre…
- CVE-2019-1000012Hex package manager version 0.14.0 through 0.18.2 contains a…
- CVE-2019-1000014Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Sig…
- CVE-2019-1000015Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cr…
- CVE-2019-1000016FFMPEG version 4.1 contains a CWE-129: Improper Validation o…
- CVE-2019-1000017Chamilo Chamilo-lms version 1.11.8 and earlier contains an I…
- CVE-2019-1000018rssh version 2.3.4 contains a CWE-77: Improper Neutralizatio…7.8
- CVE-2019-1000019libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9…6.5
Are you affected by CVE-2019-1000013?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST