VYPR
← All advisories
Unrated severityOSV Advisory· Published Feb 4, 2019· Updated Aug 5, 2024

CVE-2019-1000012

CVE-2019-1000012

Description

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Bpsoft/HexOSV2 versions
    v0.14.0, v0.14.1, v0.15.0, …+ 1 more
    • (no CPE)range: v0.14.0, v0.14.1, v0.15.0, …
    • (no CPE)range: >=0.14.0 <=0.18.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.