CVE-2019-1000012

Published: Feb 4, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.

Affected (1)

Products: Hex: Hex

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hex Hex	From 0.14.0 to 0.18.2

Related CWEs

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (4)

https://github.com/hexpm/hex/pull/646

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/hexpm/hex/pull/651

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/hexpm/hex/pull/646

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/hexpm/hex/pull/651

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.