-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure TLS configuration in the HTTP client used by makeOperatorRequest. The provided Gist explicitly shows the function initializes a client with InsecureSkipVerify:true in lib_http_client.go. While there's a path discrepancy between 'cortexlabs' and 'cortexproject' in references, the function name, context, and vulnerability pattern (CWE-599) strongly correlate. The client configuration bypasses certificate validation, making it the clear vulnerability vector as described in all advisories.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cortexproject/cortex | go | <= 0.42.1 |
GoGoOngoing coverage of React2Shell