high8.7
CVE-2024-41265
cortex establishes TLS connections with `InsecureSkipVerify` set to `true`
Impact
A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/cortexproject/cortex | <= 0.42.1 | none recorded |