GHSA-r727-5pf6-47r2
Elastic Package Registry has Improper Verification of Cryptographic Signature
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/elastic/package-registry | < 1.38.0 | 1.38.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.
References
External links from the advisory. They lead to third-party sites.