Use of Sha-1 in tusdotnet

Low severity GitHub Reviewed Published Nov 29, 2021 to the GitHub Advisory Database • Updated Feb 1, 2023

Withdrawn This advisory was withdrawn on Nov 30, 2021

Package

tusdotnet (NuGet)

Affected versions

<= 2.5.0

Patched versions

None

Description

Withdrawn

After reviewing this CVE, we have withdrawn this advisory due to it not having actual security impact.

Original Advisory

The client in tusdotnet through 2.5.0 relies on SHA-1 to prevent spoofing of file content.

References

Published by the National Vulnerability Database

Nov 22, 2021

Reviewed Nov 23, 2021

Published to the GitHub Advisory Database Nov 29, 2021

Withdrawn Nov 30, 2021

Last updated Feb 1, 2023

Severity

Low

3.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N