diff --git a/advisories/github-reviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json b/advisories/github-reviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json index 566637e8295..4bdf433e92a 100644 --- a/advisories/github-reviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json +++ b/advisories/github-reviewed/2024/08/GHSA-9v35-4xcr-w9ph/GHSA-9v35-4xcr-w9ph.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-9v35-4xcr-w9ph", - "modified": "2024-08-14T17:18:52Z", + "modified": "2025-06-11T19:56:52Z", "published": "2024-08-01T18:32:50Z", "aliases": [ "CVE-2024-41260" ], "summary": "NetBird uses a static initialization vector (IV)", - "details": "A static initialization vector (IV) in the encrypt function of netbird v0.28.4 allows attackers to obtain sensitive information.", + "details": "A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.", "severity": [ { "type": "CVSS_V3", @@ -29,10 +29,10 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "0.23.2" }, { - "last_affected": "0.28.7" + "fixed": "0.29.2" } ] } @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://github.com/netbirdio/netbird/issues/2246" }, + { + "type": "WEB", + "url": "https://github.com/netbirdio/netbird/pull/2569" + }, { "type": "WEB", "url": "https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636" @@ -70,4 +74,4 @@ "github_reviewed_at": "2024-08-07T14:16:58Z", "nvd_published_at": "2024-08-01T16:15:06Z" } -} \ No newline at end of file +}