[GHSA-9v35-4xcr-w9ph] NetBird uses a static initialization vector (IV)

[mlsmaycon]

Updates

• Description
• References
• Affected products

The issue has been fixed for quite some time. This PR documents the fix and the affected versions with a bit more context to what was affected.

[Copilot]

Pull Request Overview

This PR updates a vulnerability advisory for GHSA-9v35-4xcr-w9ph. The changes include updating the modified timestamp and details field, revising version information for when the issue was introduced and fixed, and adding an extra reference to a related pull request.

[mlsmaycon]

The package repository is a monorepo for the project, and it only affects one package/service within the project. Should I update the package URL to reflect that as well?

[helixplant]

Hi @mlsmaycon,
Thanks for including the fix version and the relevant reference, the advisory will be updated to reflect these changes. Just to verify the correct fixed version is used, is it v0.29.3 as stated in the release notes?

Additionally, to have this information updated globally, you can request a change to the CVE record and contact MITRE, the assigning CNA, at https://cveform.mitre.org/.

[mlsmaycon]

Hello, @helixplant. Thanks for sharing the CVE update information.

The fix on v0.29.3 was regarding empty encrypted data from the migration done as part of the fix in netbirdio/netbird#2569 from v0.29.2