7.5

CVE-2023-32077

Netmaker has Hardcoded DNS Secret Key

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netmaker ≫ Netmaker Version < 0.17.1
Netmaker ≫ Netmaker Version >= 0.18.0 <= 0.18.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.15% 0.863
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
security-advisories@github.com 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-321 Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51
Patch
https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657
Patch
https://github.com/gravitl/netmaker/pull/2170
Patch
https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx
Vendor Advisory