Detections
Analytics

SCA: security update for github.com/edgexfoundry/app-functions-sdk-go/v2, github.com/edgexfoundry/app-service-configurable (GHSA-6c7m-qwxj-mvhp)

medium Tenable Cloud Security Plugin ID 411362

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in
 processing/transforming/exporting data out of the EdgeX IoT platform. In affected versions broken
 encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allows
 attackers to decrypt messages via unspecified vectors. The app-functions-sdk exports an “aes” transform
 that user scripts can optionally call to encrypt data in the processing pipeline. No decrypt function is
 provided. Encryption is not enabled by default, but if used, the level of protection may be less than the
 user may expects due to a broken implementation. Version v2.1.0 (EdgeX Foundry Jakarta release and later)
 of app-functions-sdk-go/v2 deprecates the “aes” transform and provides an improved “aes256” transform in
 its place. The broken implementation will remain in a deprecated state until it is removed in the next
 EdgeX major release to avoid breakage of existing software that depends on the broken implementation. As
 the broken transform is a library function that is not invoked by default, users who do not use the AES
 transform in their processing pipelines are unaffected. Those that are affected are urged to upgrade to
 the Jakarta EdgeX release and modify processing pipelines to use the new "aes256" transform.
 (CVE-2021-41278)

See Also

https://github.com/advisories/GHSA-6c7m-qwxj-mvhp

Plugin Details

Severity: Medium

ID: 411362

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 2.6

Temporal Score: 1.9

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-41278

CVSS v3

Risk Factor: Medium

Base Score: 5.7

Temporal Score: 5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/19/2021

Vulnerability Publication Date: 11/18/2021

Reference Information

CVE: CVE-2021-41278

cwe: CWE-327