Threats tagged 'ghsa-r727-5pf6-47r2'

Elastic Package Registry versions prior to 1.38.0 contain an improper verification of cryptographic signatures vulnerability (CWE-347). This flaw could allow an attacker who can intercept network traffic or influence the contents served by a self-hosted registry to substitute a tampered package without triggering a failed integrity check. The vulnerability has a medium severity with a CVSS score of 5.9. A fix is available in version 1.38.0.