CVE-2023-32077

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*
cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*

History

21 Nov 2024, 08:02

Type Values Removed Values Added
References () https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51 - Patch () https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51 - Patch
References () https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657 - Patch () https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657 - Patch
References () https://github.com/gravitl/netmaker/pull/2170 - Patch () https://github.com/gravitl/netmaker/pull/2170 - Patch
References () https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx - Vendor Advisory () https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx - Vendor Advisory

30 Aug 2023, 18:18

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*
CWE CWE-321 CWE-798
First Time Gravitl
Gravitl netmaker
References (MISC) https://github.com/gravitl/netmaker/pull/2170 - (MISC) https://github.com/gravitl/netmaker/pull/2170 - Patch
References (MISC) https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx - (MISC) https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx - Vendor Advisory
References (MISC) https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657 - (MISC) https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657 - Patch
References (MISC) https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51 - (MISC) https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51 - Patch

24 Aug 2023, 22:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-08-24 22:15

Updated : 2024-11-21 08:02


NVD link : CVE-2023-32077

Mitre link : CVE-2023-32077

CVE.ORG link : CVE-2023-32077


JSON object : View

Products Affected

gravitl

  • netmaker
CWE
CWE-321

Use of Hard-coded Cryptographic Key

CWE-798

Use of Hard-coded Credentials