🔒Radicle Vulnerabilities Expose Private Repositories
Your private repos are at risk, Radicle users
TL;DR
Two critical security flaws in Radicle's network protocol expose private repositories to unauthorized access. Encryption in transit is crucial for private repos until a fix is released.
Two critical security vulnerabilities in Radicle's network protocol have been reported, affecting all versions released to date. The main concern is information leakage, with network traffic between nodes not encrypted or authenticated. For private repositories, encryption in transit is crucial to prevent unauthorized access. A fix is being developed, but it will be a breaking change, requiring a major version bump. The resolution involves replacing Radicle's networking protocol with iroh, an open-source peer-to-peer networking stack. Until then, users should stop seeding private repositories and consider additional encrypted transports or waiting for the security update.
Key Points
Two critical security vulnerabilities in Radicle's network protocol affect all versions released to date.
Network traffic between nodes is not encrypted or authenticated, allowing attackers to read data in transit.
Private repositories are shared only with allow-listed Node IDs, but an attacker can impersonate an allow-listed ID.
A fix is being developed, but it will require a major version bump and cause network partitioning.
The resolution involves replacing Radicle's networking protocol with iroh, an open-source peer-to-peer networking stack.
Why It Matters
If you're using Radicle for private repositories, your data is at risk until the security update is released. Encryption in transit is crucial, and stopping seeding private repositories is recommended. The fix will involve a major version bump and network partitioning.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,489 builders reading daily.