CVE-2019-1000012

2019-02-0421:29:01

Google

osv.dev

7.3 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.5%

JSON

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.

CPENameOperatorVersion
hexeq0.16.0
hexeq0.18.0
hexeq0.15.0
hexeq0.18.1
hexeq0.18.2
hexeq0.17.1
hexeq0.16.1
hexeq0.17.5
hexeq0.14.0
hexeq0.17.7

Name	Operator	Version
hex	eq	0.16.0
hex	eq	0.18.0
hex	eq	0.15.0
hex	eq	0.18.1
hex	eq	0.18.2
hex	eq	0.17.1
hex	eq	0.16.1
hex	eq	0.17.5
hex	eq	0.14.0
hex	eq	0.17.7

Rows per page:

1-10 of 161

References

github.com/hexpm/hex/pull/646

github.com/hexpm/hex/pull/651