HIGH🇵🇱 Wersja polska

CVE-2019-1000013

CVSS 8.8v3.0pub. 2019-02-04upd. 2024-11-21

Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  • Hex Core

    APP
    Hex
    ≤ 0.3.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2026-21619LOW2.0ten sam produkt

Podatność Uncontrolled Resource Consumption oraz Deserialization of Untrusted Data w modułach hex_api bibliote...

CVE-2026-21622CRITICAL9.5PL ✓ten sam vendor

Brak wygasania tokenów resetowania hasła w Hex (hexpm) — przejęcie konta

CVE-2026-32148HIGH8.9ten sam vendor

Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows ...

CVE-2026-23940HIGH7.1ten sam vendor

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing a...

CVE-2026-21621HIGH7.0ten sam vendor

Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allo...