CVE-2024-41265: TLS certificate verification issue in cortex v0.42.1
Summary
CVE-2024-41265: cortex establishes TLS connections with InsecureSkipVerify set to true. Affects github.com/cortexproject/cortex versions < 0.42.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cortex is an open-source project written in Go that provides a horizontally scalable, long-term storage for Prometheus metrics. It allows users to store and query large amounts of time-series data efficiently. The vulnerability affects version 0.42.1 of the cortex package.
Vulnerability Detail
The TLS certificate verification issue in cortex v0.42.1 arises from the use of the InsecureSkipVerify option when establishing TLS connections. This allows attackers to obtain sensitive information by bypassing certificate validation. The makeOperatorRequest function is specifically affected by this vulnerability. Exploiting this issue can lead to unauthorized access and potential data leakage.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can modify the code to disable the InsecureSkipVerify option and enforce proper certificate validation. Here is an example of how to modify the makeOperatorRequest function:
// Original code
func makeOperatorRequest() {
// TLS configuration
tlsConfig := &tls.Config{
InsecureSkipVerify: true,
}
// Rest of the code
}
// Modified code
func makeOperatorRequest() {
// TLS configuration
tlsConfig := &tls.Config{
InsecureSkipVerify: false,
}
// Rest of the code
}
Conclusion
The TLS certificate verification issue in cortex v0.42.1 poses a significant security risk as it allows attackers to bypass certificate validation and obtain sensitive information. It is crucial to update the cortex package to a fixed version and ensure proper certificate validation to mitigate this vulnerability.
See every vulnerability recorded for github.com/cortexproject/cortex →
FAQ
Cortex is an open-source project written in Go that provides a horizontally scalable, long-term storage for Prometheus metrics. It allows users to store and query large amounts of time-series data efficiently.
Version 0.42.1 of the cortex package is affected by this TLS certificate verification issue.
This vulnerability allows attackers to obtain sensitive information by bypassing certificate validation. It can lead to unauthorized access and potential data leakage.
To fix this vulnerability, update the cortex package to a version that addresses the TLS certificate verification issue. Ensure that TLS connections are established with proper certificate validation.
Yes, as a temporary workaround, you can modify the code to disable the InsecureSkipVerify option and enforce proper certificate validation. Refer to the 'workaround' section for more details.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cortexproject/cortex.
