CVE-2024-41270

gistfile1.txt

[Suggested description]
 Gorush v1.18.4 was discovered to use a deprecated version of TLS.

In the RunHTTPServer function within the server_normal.go file
of the appleboy/gorush/router package, our server currently supports TLS 1.0 and TLS 1.1.

Impact:
Continuing to support TLS 1.0 and TLS 1.1 exposes our 
application to potential security risks, including but not limited to:

Vulnerabilities: TLS 1.0 and TLS 1.1 have known weaknesses that could be exploited by attackers, leading to data breaches or other security incidents.
Interception: The outdated protocols may allow for man-in-the-middle attacks, enabling adversaries to intercept and manipulate data in transit.
Compliance Issues: Supporting these outdated protocols may violate industry standards and best practices, potentially leading to compliance penalties or legal repercussions.
 ------------------------------------------

 [VulnerabilityType Other]
 CWE-327

 ------------------------------------------

 [Vendor of Product]
 https://github.com/appleboy/gorush  https://opencollective.com/gorush

 ------------------------------------------

 [Affected Product Code Base]
 gorush - <=1,18,4

 ------------------------------------------

 [Affected Component]
 http service

 ------------------------------------------

 [Attack Type]
 Remote

 ------------------------------------------

 [Impact Information Disclosure]
 true

 ------------------------------------------

 [Attack Vectors]
 After configuring autotls to false, the HTTP service used thereafter will automatically support a minimum version of tls1.0

------------------------------------------

 [Discoverer]
 Bingyu Li

 ------------------------------------------

 [Reference]
 http://gorush.com
 https://github.com/appleboy/gorush