CVE-2020-4045

SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages when you explicitly ask it to, but there is a bug where it's decrypting any message that it can. This means that it is returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around get() to anonymous peers. This is fixed in version 20.0.1. Note that users of SSB-Server verion 16.0.0 should upgrade to 16.0.1 to get the fixed version of SSB-DB.

• CWE-200

• https://github.com/ssbc/ssb-db/commit/43334d0871c9cc6220e0f6d6338499060f7761d4Patch, Third Party Advisory
• https://github.com/ssbc/ssb-db/security/advisories/GHSA-mpgr-2cx9-327hThird Party Advisory
• https://github.com/ssbc/ssb-db/commit/43334d0871c9cc6220e0f6d6338499060f7761d4Patch, Third Party Advisory
• https://github.com/ssbc/ssb-db/security/advisories/GHSA-mpgr-2cx9-327hThird Party Advisory

Published

Jun 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-4039SUSI.AI is an intelligent Open Source personal assistant. SU…9.1
• CVE-2020-4040Bolt CMS before version 3.7.1 lacked CSRF protection in the …4.3
• CVE-2020-4041In Bolt CMS before version 3.7.1, the filename of uploaded f…6.1
• CVE-2020-4042Bareos before version 19.2.8 and earlier allows a malicious …6.8
• CVE-2020-4043phpMussel from versions 1.0.0 and less than 1.6.0 has an uns…9.8
• CVE-2020-4044The xrdp-sesman service before version 0.9.13.1 can be crash…7.8
• CVE-2020-4046In affected versions of WordPress, users with low privileges…5.4
• CVE-2020-4047In affected versions of WordPress, authenticated users with …6.8
• CVE-2020-4048In affected versions of WordPress, due to an issue in wp_val…5.7
• CVE-2020-4049In affected versions of WordPress, when uploading themes, th…2.4
• CVE-2020-4050In affected versions of WordPress, misuse of the `set-screen…3.1
• CVE-2020-4051In Dijit before versions 1.11.11, and greater than or equal …5.4