4 results · Clear filters · Feed
-
Medium 5.9
erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar module), hexpm hex (mix_hex_erl_tar module) and erlang rebar3 (r3_hex_erl_tar module) allows an attacker who supplies a tar…
-
Medium 6.9
Hex writes unverified package tarballs to standard output in mix hex.package fetch
Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output. Hex compares a fetched tarball's inner and outer checksu…
-
Medium 5.9
Hex trusts its bundled CA certificates when cacerts_path is set
Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA …
-
Medium 5.9
hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25
Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP …