Gorush uses deprecated TLS versions

CRITIQUE 9.1CVE-2024-41270 · GHSA-p3pf-mff8-3h47 · GO-2024-3058 · Published 06/08/2024 · updated 17/06/2026

En bref

CVE-2024-41270 est une vulnérabilité CRITIQUE (CVSS 9.1) touchant github.com/appleboy/gorush, gorush (appleboy).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.31%, plus élevée que 23.8% des vulnérabilités.
Correctif : mettre à jour vers 1.18.5 ou plus récent.

Package	Affected versions	Patched versions
github.com/appleboy/gorush Go	`< 1.18.5`	`1.18.5`
gorush appleboy	`≤ 1.18.4`	No fix yet

Description

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.

NVD description

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.

References

nvd.nist.gov/vuln/detail/CVE-2024-41270 · ADVISORY
appleboy/gorush · WEB
appleboy/gorush commit 067cb59 · WEB
gist.github.com/nyxfqq/cfae38fada582a0f576d154be1aeb1fc · WEB
appleboy/gorush · PACKAGE
GitHub Advisory GHSA-p3pf-mff8-3h47 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free