What is GHSA-vfxc-r2gx-v2vq?

GHSA-vfxc-r2gx-v2vq is a security advisory published by GitHub Security Advisories with High severity. Hybrid Group Gobot Improper Certificate Validation vulnerability

Which CVE IDs does GHSA-vfxc-r2gx-v2vq cover?

GHSA-vfxc-r2gx-v2vq covers the following CVE IDs: CVE-2019-12496. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vfxc-r2gx-v2vq?

GHSA-vfxc-r2gx-v2vq has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-vfxc-r2gx-v2vq?

GHSA-vfxc-r2gx-v2vq affects 1 product, including: go/github.com/hybridgroup/gobot:\u003c 1.12.1-0.20190521122906-c1aa4f867846.

GHSA-vfxc-r2gx-v2vqHighCVSS 7.5

Hybrid Group Gobot Improper Certificate Validation vulnerability

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

September 29, 2023

🔗 CVE IDs covered (1)

CVE-2019-12496 →

📋 Description

An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default.

Specific Go Packages Affected

github.com/hybridgroup/gobot/platforms/mqtt

🎯 Affected products1

go/github.com/hybridgroup/gobot:< 1.12.1-0.20190521122906-c1aa4f867846

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-12496
https://github.com/hybridgroup/gobot/compare/ed53198...7f973df
https://github.com/hybridgroup/gobot/releases/tag/v1.13.0
https://github.com/hybridgroup/gobot/commit/c1aa4f867846da4669ecf3bc3318bd96b7ee6f3f
https://pkg.go.dev/vuln/GO-2021-0083
https://github.com/advisories/GHSA-vfxc-r2gx-v2vq