CVE-2019-1000014

2019-02-0421:29:01

Google

osv.dev

7.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.8%

JSON

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.

CPENameOperatorVersion
rebar3eq3.7.2
rebar3eq3.7.5
rebar3eq3.7.1
rebar3eq3.7.0
rebar3eq3.7.3
rebar3eq3.7.4

Name	Operator	Version
rebar3	eq	3.7.2
rebar3	eq	3.7.5
rebar3	eq	3.7.1
rebar3	eq	3.7.0
rebar3	eq	3.7.3
rebar3	eq	3.7.4

References

github.com/erlang/rebar3/pull/1986