GHSA-86f3-hf24-76q4

Use of Hard-coded Cryptographic Key in Netmaker

Source: GitHub Advisory Database (reviewed) High CVE-2022-23650

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/gravitl/netmaker	< 0.8.5	0.8.5
Go	github.com/gravitl/netmaker	>= 0.9.0, < 0.9.4	0.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact There is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server, if you know the address and username of the admin. This effects the server (netmaker) component, and not clients. ### Patches This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. If you are running these versions, the fix is to perform the following: 1. docker-compose down 2. docker pull gravitl/netmaker:( version ) 3. docker-compose up -d #### Additional Information If you are running **any other version**, you will need to upgrade to one of these three versions. If you have a special circumstance that requires running a different version, let us know and we may be able to build a custom patch. ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.