Security Digest · Critical advisory (no CVE assigned)
GHSA-x5r5-2qrx-rqj8: Transparent TLS may not be applied to Marbles with certain manifest configurations
Transparent TLS (TTLS) is a MarbleRun feature that wraps plain TCP connections between Marbles in TLS.
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/edgelesssys/marblerun | < 1.4.1 | 1.4.1 |
Details
Transparent TLS (TTLS) is a MarbleRun feature that wraps plain TCP connections between Marbles in TLS. In the manifest, a user defines the connections that should be considered.
Impact If a Marble is configured for TTLS, but doesn't have an environment variable defined in its parameters, TTLS is not applied. The traffic will not be encrypted.
MarbleRun deployments that don't use TTLS (which is only available with EGo Marbles) are not affected.
Patches The issue has been patched in v1.4.1.
Workarounds Make sure that all Marbles that use TTLS have an environment variable defined in their parameters.
References For a description of TTLS, see See the updated section on TTLS configuration in the manifest:
CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Sources and references
- GitHub Advisory GHSA-x5r5-2qrx-rqj8 github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com