Detections
Analytics
SCA: security update for ssb-db (GHSA-mpgr-2cx9-327h)
high Tenable Cloud Security Plugin ID 417058
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only
decrypt messages when you explicitly ask it to, but there is a bug where it's decrypting any message that
it can. This means that it is returning the decrypted content of private messages, which a malicious peer
could use to get access to private data. This only affects peers running [email protected] who also have
private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-
Server), which exposes a thin wrapper around get() to anonymous peers. This is fixed in version 20.0.1.
Note that users of SSB-Server verion 16.0.0 should upgrade to 16.0.1 to get the fixed version of SSB-DB.
(CVE-2020-4045)
See Also
Plugin Details
Severity: High
ID: 417058
Version: Revision 1.5
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2020-4045
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/11/2020
Vulnerability Publication Date: 6/11/2020
Reference Information
CVE: CVE-2020-4045
cwe: CWE-200