| Package | Affected versions | Patched versions |
|---|---|---|
| wazuh | ≥ 4.1.3, < 4.14.0 | 4.14.0 |
Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free