Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

ssb-db

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5npmAmendedPublished

    Information disclosure in SSB-DB

    CVE-2020-4045 · GHSA-mpgr-2cx9-327h

    Affected
    • npm ssb-db >= 20.0.0, <= 20.0.0
    Fixed in
    20.0.1· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Servers running SSB-DB 20.0.0 (which is packaged with SSB-Server 16.0.0) must upgrade immediately. There is no evidence that other SSB apps are vulnerable or that this problem has been exploited in the wild. The get() method is supposed to only decrypt messages when you explicitly ask it to, but there's a bug where it's decrypting any message that it can. This means that it's returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around get() to anonymous peers. Patches Has the problem been patched? What versions should users upgrade to? Yes, please upgrade to SSB-DB 20.0.1 (or SSB-Server 16.0.1) immediately. Workarounds Is there a way for users to fix or remediate the…

    Recommended action: Upgrade to 20.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →