hex vulnerabilities

A vulnerability in the hex library allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. The issue stems from missing size limits on HTTP responses, gzip decompression, and tarball extraction before checksum verification.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory outside the project's deps directory and extract package files into it when a developer fetches dependencies. The app label in package requirements is not validated, allowing values like ../../target, leading to directory deletion and file writes outside the project.

Vulnerability in Hex allows a malicious package publisher or hostile repository server to inject terminal control sequences into Mix task output. Hex prints data from the repository and documentation search service without neutralizing control characters.

A vulnerability in the hex package manager allows the package owner or an attacker who has taken over the owner's account to publish a new release bypassing the release-age cooldown. The cooldown mechanism that blocks too-fresh versions can be bypassed by retiring the currently locked version, causing the next update to select the new version regardless of its age. Affects hex from 2.5.0 before 2.5.2.

Improper validation of integrity check value in hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.

Improper certificate validation in hex allows an attacker who can intercept HTTPS connections and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.