Gorush uses deprecated TLS versions

CRITICO 9.1CVE-2024-41270 · GHSA-p3pf-mff8-3h47 · GO-2024-3058 · Published 06/08/2024 · updated 17/06/2026

In breve

CVE-2024-41270 è una vulnerabilità CRITICO (CVSS 9.1) che riguarda github.com/appleboy/gorush, gorush (appleboy).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.31%, superiore al 23.8% delle vulnerabilità.
Correzione: aggiornare a 1.18.5 o successiva.

Package	Affected versions	Patched versions
github.com/appleboy/gorush Go	`< 1.18.5`	`1.18.5`
gorush appleboy	`≤ 1.18.4`	No fix yet

Description

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.

NVD description

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version.

References

nvd.nist.gov/vuln/detail/CVE-2024-41270 · ADVISORY
appleboy/gorush · WEB
appleboy/gorush commit 067cb59 · WEB
gist.github.com/nyxfqq/cfae38fada582a0f576d154be1aeb1fc · WEB
appleboy/gorush · PACKAGE
GitHub Advisory GHSA-p3pf-mff8-3h47 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free