Detections
Analytics
SCA: security update for github.com/codenotary/immudb (GHSA-6cqj-6969-p57x)
medium Tenable Self-Hosted Container Security Plugin ID 411379
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's
UUID to distinguish between different server instance so that the client can connect to different immudb
instances and keep the state for multiple servers. SDK does not validate this uuid and can accept any
value reported by the server. A malicious server can change the reported UUID tricking the client to treat
it as a different server thus accepting a state completely irrelevant to the one previously retrieved from
the server. This issue has been patched in version 1.4.1. As a workaround, when initializing an immudb
client object a custom state handler can be used to store the state. Providing custom implementation that
ignores the server UUID can be used to ensure that even if the server changes the UUID, client will still
consider it to be the same server. (CVE-2022-39199)
See Also
Plugin Details
Severity: Medium
ID: 411379
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N
CVSS Score Source: CVE-2022-39199
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 11/21/2022
Vulnerability Publication Date: 11/21/2022
Reference Information
CVE: CVE-2022-39199
cwe: CWE-345