What is GHSA-8948-ffc6-jg52?

GHSA-8948-ffc6-jg52 is a security advisory published by GitHub Security Advisories with Medium severity. Insecure Default Configuration in redbird

Why does GHSA-8948-ffc6-jg52 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-8948-ffc6-jg52?

GHSA-8948-ffc6-jg52 has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

Which products are affected by GHSA-8948-ffc6-jg52?

GHSA-8948-ffc6-jg52 affects 1 product, including: npm/redbird:\u003c= 0.9.0.

GHSA-8948-ffc6-jg52MediumCVSS 4.2Disclosed before NVD

Insecure Default Configuration in redbird

Vendor

GitHub Security Advisories

Published

June 6, 2019

Last Modified

January 9, 2023

📋 Description

Versions of redbird prior to 0.9.1 have a vulnerable default configuration of allowing TLS 1.0 connections on lib/proxy.js. The package does not provide an option to disable TLS 1.0 which is deprecated and vulnerable.

Recommendation

Upgrade to version 0.9.1 or later.

🎯 Affected products1

npm/redbird:<= 0.9.0

🔗 References (5)

https://github.com/OptimalBits/redbird/pull/207
https://github.com/OptimalBits/redbird/commit/39c7a2da84a2ddddfe046ea80e98800518920516
https://snyk.io/vuln/SNYK-JS-REDBIRD-174455
https://www.npmjs.com/advisories/828
https://github.com/advisories/GHSA-8948-ffc6-jg52