VYPR
← All advisories
High severity8.8OSV Advisory· Published Feb 4, 2019· Updated Jun 17, 2026

CVE-2019-1000012

CVE-2019-1000012

Description

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Bpsoft/HexOSV3 versions
    v0.14.0, v0.14.1, v0.15.0, …+ 2 more
    • (no CPE)range: v0.14.0, v0.14.1, v0.15.0, …
    • cpe:2.3:a:hex:hex:*:*:*:*:*:*:*:*range: >=0.14.0,<=0.18.2
    • (no CPE)range: 0.14.0 - 0.18.2

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.