CVE-2022-0664: Hard-coded Cryptographic Key in Netmaker
Summary
CVE-2022-0664: Use of Hard-coded Cryptographic Key in Netmaker. Affects github.com/gravitl/netmaker across 2 version ranges.
< 0.8.5
>= 0.9.0, < 0.9.4
Fixed in 0.8.5 or 0.9.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is a Go package that provides networking and connectivity solutions. It is used to create and manage virtual networks, allowing secure communication between nodes. The package offers various features such as encryption, authentication, and routing. However, a vulnerability has been discovered in Netmaker versions prior to 0.8.5, 0.9.4, 0.10.0, and 0.10.1. This vulnerability involves the use of a hard-coded cryptographic key, which poses a significant security risk.
Vulnerability Detail
The vulnerability in Netmaker arises from the use of a hard-coded cryptographic key. This means that the same key is used across all installations of the package, making it easily discoverable by attackers. By obtaining the key, an attacker can potentially decrypt sensitive data, impersonate legitimate nodes, and perform other malicious activities. The impact of this vulnerability is high, as it compromises the confidentiality, integrity, and availability of the affected systems.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.8.50.8.5go get github.com/gravitl/netmaker@v0.8.5 -
>= 0.9.0, < 0.9.40.9.4go get github.com/gravitl/netmaker@v0.9.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Netmaker to the fixed versions mentioned above.
Conclusion
The use of a hard-coded cryptographic key in Netmaker versions prior to 0.8.5, 0.9.4, 0.10.0, and 0.10.1 poses a significant security risk. It is crucial to update Netmaker to the fixed versions to mitigate the vulnerability and ensure the security of the network. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
This vulnerability allows attackers to decrypt sensitive data, impersonate legitimate nodes, and perform other malicious activities.
You can use Vulert's playground (https://vulert.com/scanner) to check if your version of Netmaker is affected by this vulnerability. Simply upload your Gopkg.lock file and Vulert will provide real-time alerts for open-source vulnerabilities.
At the time of this report, there are no known exploits for this vulnerability. However, it is crucial to update Netmaker to the fixed versions to mitigate the risk.
No, the cryptographic key is hard-coded in the affected versions of Netmaker. The only way to address the vulnerability is to update to the fixed versions.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
