Description (CNA)
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| eidetic-labs / stigmem | affected 0 before 0.9.0a2; unaffected 0.9.0a2 |
CWE
CWE-319
References
- https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-jmfc-hfjq-pxcp
- https://www.vulncheck.com/advisories/stigmem-node-insecure-federation-transport-configuration
ADP enrichment
No English description supplied.
No references supplied.