Miggo Logo
Miggo Vulnerability Database
→
GHSA-7xg2-83f8-39mr

GHSA-7xg2-83f8-39mr:
The DES/3DES cipher was used as part of the TLS protocol by installation tools

N/A

CVSS Score

Basic Information

CVE ID
-
GHSA ID
GHSA-7xg2-83f8-39mr
EPSS Score
-
CWE
-
Published
1/3/2024
Updated
1/3/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/karmada-io/karmadago< 1.8.01.8.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the use of Golang's default TLS configuration, which includes insecure 3DES ciphers, in several Karmada components. However, the provided data shows the issue was addressed by adding --tls-min-version=VersionTLS13 flags to deployment manifests and Helm/operator templates, rather than modifying specific code functions. The vulnerability arises from configuration defaults, not from identifiable functions in the codebase. The patches adjust command-line arguments for components like karmada-apiserver, but no functions in the Go code (e.g., TLS configuration logic) are explicitly shown to be vulnerable in the provided diffs. Thus, no specific functions in the code can be pinpointed with high confidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t _W**t kin* o* vuln*r**ility is it? W*o is imp**t**?_ T** K*rm*** *ompon*nts **ploy** wit* `k*rm****tl`, `k*rm*-op*r*tor`, *n* `**lm ***rt` t*k* *ol*n* ****ult *ip**r suit*s *s p*rt o* t** TLS proto*ol, w*i** in*lu**s t** ins**ur* *l*orit*

Reasoning

T** vuln*r**ility st*ms *rom t** us* o* *ol*n*'s ****ult TLS *on*i*ur*tion, w*i** in*lu**s ins**ur* ***S *ip**rs, in s*v*r*l K*rm*** *ompon*nts. *ow*v*r, t** provi*** **t* s*ows t** issu* w*s ***r*ss** *y ***in* `--tls-min-v*rsion=V*rsionTLS**` *l**s