CVE-2023-32198
CVE-2023-32198 · Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.
CVSS 8.0 · High · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
steve
- Versions
- ≥ 0.2.0, < 0.2.1: Affected (semver)
- ≥ 0.3.0, < 0.3.3: Affected (semver)
- ≥ 0.4.0, < 0.4.4: Affected (semver)
- ≥ 0.5.0, < 0.5.13: Affected (semver)
Update to 0.2.1; Update to 0.3.3; Update to 0.4.4; Update to 0.5.13