Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/edgexfoundry/device-sdk-go/v2

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9GoPublished

    Configuration API in EdgeXFoundry 2.1.0 and earlier exposes message bus credentials to local unauthenticated users

    CVE-2022-31066 · GHSA-g63h-q855-vp3q

    Affected
    • Go github.com/edgexfoundry/device-sdk-go/v2 < 2.1.1
    Fixed in
    2.1.1· Vendor fix available
    Issue
    Impact The /api/v2/config endpoint exposes message bus credentials to local unauthenticated users. In security-enabled mode, message bus credentials are supposed to be kept in the EdgeX secret store and require authentication to access. This vulnerability bypasses the access controls on message bus credentials when running in security-enabled mode. (No credentials are required when running in security-disabled mode.) As a result, attackers could intercept data or inject fake data into the EdgeX message bus. Patches Users should upgrade to EdgeXFoundry Kamakura release (2.2.0) or to the June 2022 EdgeXFoundry LTS Jakarta release (2.1.1). The issue has been patched in the following docker containers and snaps: Patched go modules github.com/edgexfoundry/device-sdk-go/v2 = v2.1.1 github.com/edgexfoundry/app-functions-sdk-go/v2 = v2.1.1 Patched docker containers URL: https://hub.docker.com/r/edgexfoundry - docker.io/edgexfoundry/core-metadata:=2.1.1 -…

    Recommended action: Upgrade to 2.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →