{"id":"GO-2022-1117","summary":"Insufficient verification of proofs in github.com/codenotary/immudb","details":"In certain scenarios, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a genuine immudb server and requires the client to perform a specific list of verified operations resulting in acceptance of an invalid state value.\n\nThis vulnerability only affects immudb client SDKs, the immudb server itself is not affected by this vulnerability.","aliases":["CVE-2022-36111","GHSA-672p-m5jq-mrh8"],"modified":"2024-05-20T16:03:47Z","published":"2022-12-22T22:30:39Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2022-1117"},"references":[{"type":"ADVISORY","url":"https://github.com/codenotary/immudb/security/advisories/GHSA-672p-m5jq-mrh8"},{"type":"ARTICLE","url":"https://github.com/codenotary/immudb/tree/master/docs/security/vulnerabilities/linear-fake"},{"type":"FIX","url":"https://github.com/codenotary/immudb/commit/acf7f1b3d62436ea5e038acea1fc6394f90ab1c6"},{"type":"FIX","url":"https://github.com/codenotary/immudb/commit/7267d67e28be8f0257b71d734611a051593e8a81"}],"affected":[{"package":{"name":"github.com/codenotary/immudb","ecosystem":"Go","purl":"pkg:golang/github.com/codenotary/immudb"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/codenotary/immudb/pkg/client/auditor","symbols":["defaultAuditor.Run","defaultAuditor.audit"]},{"path":"github.com/codenotary/immudb/pkg/client","symbols":["immuClient.SafeGet","immuClient.SafeReference","immuClient.SafeSet","immuClient.SafeZAdd","immuClient.StreamVerifiedGet","immuClient.StreamVerifiedSet","immuClient.VerifiedGet","immuClient.VerifiedGetAt","immuClient.VerifiedGetAtRevision","immuClient.VerifiedGetSince","immuClient.VerifiedSet","immuClient.VerifiedSetReference","immuClient.VerifiedSetReferenceAt","immuClient.VerifiedTxByID","immuClient.VerifiedZAdd","immuClient.VerifiedZAddAt","immuClient.VerifyRow","immuClient._streamVerifiedGet","immuClient._streamVerifiedSet","immuClient.verifiedGet"]},{"path":"github.com/codenotary/immudb/embedded/store","symbols":["ImmuStore.DualProof","VerifyDualProof","VerifyLinearProof"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2022-1117.json"}}],"schema_version":"1.7.3"}