QID 983867

QID 983867: Nodejs (npm) Security Update for ssb-db (GHSA-mpgr-2cx9-327h)

Security update has been released for ssb-db to fix the vulnerability. Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

_What kind of vulnerability is it? Who is impacted?_ Servers running SSB-DB 20.0.0 (which is packaged with SSB-Server 16.0.0) must upgrade immediately. **There is no evidence that other SSB apps are vulnerable or that this problem has been exploited in the wild.** The `get()` method is supposed to only decrypt messages when you explicitly ask it to, but there's a bug where it's decrypting any message that it can. This means that it's returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running [email protected] who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around `get()` to anonymous peers.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

_Has the problem been patched? What versions should users upgrade to?_ Yes, please upgrade to SSB-DB 20.0.1 (or SSB-Server 16.0.1) immediately.Workaround:
_Is there a way for users to fix or remediate the vulnerability without upgrading?_ You may be able to disable the most obvious attack vector, SSB-OOO, by disabling the plugin, but you should upgrade immediately anyway.

Vendor References

GHSA-mpgr-2cx9-327h - github.com/advisories/GHSA-mpgr-2cx9-327h

CVEs related to QID 983867

CVE-2020-4045 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-mpgr-2cx9-327h	ssb-db		github.com/advisories/GHSA-mpgr-2cx9-327h

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].