Elastic Package Registry Improper Cryptographic Signature Verification Vulnerability Allowing Package Integrity Bypass

A vulnerability exists in Elastic Package Registry versions prior to 1.38.0, specifically in self-hosted deployments that sync packages from an upstream source. This vulnerability stems from improper verification of cryptographic signatures, which could enable an attacker to intercept network traffic or influence the contents served to the registry. As a result, a tampered package could be substituted without triggering a failure in the integrity check.

Impact

Exploitation of this vulnerability could lead to the substitution of tampered packages in the registry, bypassing integrity checks and potentially allowing malicious packages to be introduced into the system.

Remediation

Users can upgrade to Elastic Package Registry version 1.38.0 to address this vulnerability.