PatchTheCVEconduit vulnerabilities and fixes
Recent CVEs affecting conduit, with upgrade or downgrade steps. 5 tracked.
conduit has 5 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2024-06-25. Highest priority: CVE-2024-6303 (score 44/100).
- CVE-2024-6303 CRITICAL 9.9 UPGRADE Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added
- CVE-2024-6302 HIGH 8.1 UPGRADE Lack of privilege checking when processing a redaction in Conduit versions v0.6.0 and lower, allowing a local
- CVE-2024-6301 MEDIUM 5.3 UPGRADE Lack of validation of origin in federation API in Conduit, allowing any remote server to impersonate any user
- CVE-2024-6300 LOW 3.7 UPGRADE Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain string
- CVE-2024-6299 MEDIUM 4.8 UPGRADE Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has comp
FAQ
How do I fix conduit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is conduit being exploited right now?
None of the tracked conduit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which conduit CVE should I patch first?
CVE-2024-6303 currently ranks highest (44/100): Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added .