GHSA-9v35-4xcr-w9ph
NetBird uses a static initialization vector (IV)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/netbirdio/netbird | >= 0.23.2, < 0.29.2 | 0.29.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2024-41260
- https://github.com/netbirdio/netbird/issues/2246
- https://github.com/github/advisory-database/pull/5714
- https://github.com/netbirdio/netbird/pull/2569
- https://github.com/netbirdio/netbird/commit/cf6210a6f42355e88c422c624376f6fcdaea6729
- https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636
- https://github.com/advisories/GHSA-9v35-4xcr-w9ph
- https://github.com/netbirdio/netbird