CVE-2020-4045: Information disclosure in SSB-DB
Summary
CVE-2020-4045: Information disclosure in SSB-DB. Affects ssb-db versions >= 20.0.0, < 20.0.1. Fixed in 20.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SSB-DB is a package used for secure scuttlebutt (SSB) applications. It provides a database for storing and retrieving messages in a decentralized peer-to-peer network. SSB-DB 20.0.0, which is bundled with SSB-Server 16.0.0, is affected by an information disclosure vulnerability.
Vulnerability Detail
The vulnerability allows malicious peers to access the decrypted content of private messages. The get() method in SSB-DB is supposed to decrypt messages only when explicitly requested, but due to a bug, it decrypts any message it can. This issue affects peers running SSB-DB@20.0.0 with private messages and can be exploited if SSB-OOO (default in SSB-Server) is also running, exposing a wrapper around get() to anonymous peers. The impact of this vulnerability is high as it can lead to unauthorized access to private data.
How To Fix
Minimum fixed version
20.0.1
This is the first release that contains the fix.
npm install ssb-db@20.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While upgrading is the recommended solution, users can disable the SSB-OOO plugin to mitigate the risk. However, it is still advised to upgrade to the latest version as soon as possible.
Conclusion
Upgrading to the latest version of SSB-DB or SSB-Server is crucial to mitigate the information disclosure vulnerability. Disabling the SSB-OOO plugin can provide a temporary workaround, but it is recommended to upgrade as soon as possible. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ssb-db →
FAQ
SSB-DB 20.0.0 is the only affected version.
No, there is no evidence that other SSB apps are vulnerable to this specific problem.
There is no known exploitation of this vulnerability in the wild.
The vulnerability has a CVSS score of 7.5, indicating a high severity level.
For more information, you can open an issue in the SSB-DB GitHub repository: https://github.com/ssbc/ssb-db
