Information disclosure in ssb-server and ssb-db - CVE-2020-4045

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application in the "get()" method. A remote attacker can gain unauthorized access to sensitive information on the system.

Note: This only affects peers who also have private messages, and is only known to be exploitable if you're also running in SSB-Server.

Affected software

How to mitigate CVE-2020-4045

External References

• https://github.com/ssbc/ssb-db/commit/43334d0871c9cc6220e0f6d6338499060f7761d4
• https://github.com/ssbc/ssb-db/security/advisories/GHSA-mpgr-2cx9-327h

Related Security Bulletins

• Information disclosure in SSB-DB and SSB-Server packages for npm