CVE-2019-1000014
Last modified
CVE-2019-1000014 is a vulnerability of currently unknown severity. Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. EPSS estimates a 1.79% chance of exploitation in the next 30 days.
Description
Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Erlang | Rebar3 | >= 3.7.0, <= 3.7.5 |
References
- https://github.com/erlang/rebar3/pull/1986Issue Tracking, Third Party Advisory
- https://github.com/erlang/rebar3/pull/1986Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-1000014?
How severe is CVE-2019-1000014?
How do I fix CVE-2019-1000014?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-1000008All versions of Helm between Helm >=2.0.0 and < 2.12.2 conta…
- CVE-2019-1000009Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-…
- CVE-2019-1000010phpIPAM version 1.3.2 and earlier contains a Cross Site Scri…
- CVE-2019-1000011API Platform version from 2.2.0 to 2.3.5 contains an Incorre…
- CVE-2019-1000012Hex package manager version 0.14.0 through 0.18.2 contains a…
- CVE-2019-1000013Hex package manager hex_core version 0.3.0 and earlier conta…
- CVE-2019-1000015Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cr…
- CVE-2019-1000016FFMPEG version 4.1 contains a CWE-129: Improper Validation o…
- CVE-2019-1000017Chamilo Chamilo-lms version 1.11.8 and earlier contains an I…
- CVE-2019-1000018rssh version 2.3.4 contains a CWE-77: Improper Neutralizatio…7.8
- CVE-2019-1000019libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9…6.5
- CVE-2019-1000020libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb…6.5
Are you affected by CVE-2019-1000014?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST