CVE-2024-41254

gistfile1.txt

[Suggested description]
 An issue was discovered in litestream v0.3.13. The usage of the
 ssh.InsecureIgnoreHostKey() disables host key verification, possibly
 allowing attackers to obtain sensitive information via a
 man-in-the-middle attack.

 ------------------------------------------

 [VulnerabilityType Other]
 CWE305 306

 ------------------------------------------

 [Vendor of Product]
 https://github.com/benbjohnson/litestream

 ------------------------------------------

 [Affected Product Code Base]
 litestream - <=0.3.13

 ------------------------------------------

 [Affected Component]
 ReplicaClient

 ------------------------------------------

[Attack Type]
 Remote

 ------------------------------------------

 [Impact Escalation of Privileges]
 true

------------------------------------------

 [Impact Information Disclosure]
 true

 ------------------------------------------

 [Attack Vectors]
 use ssh connect database

 ------------------------------------------

 [Discoverer]
 Bingyu Li

 ------------------------------------------

 [Reference]
 http://litestream.com
 https://github.com/benbjohnson/litestream