From Radicle · · 1m 10s
Radicle Network Protocol Vulnerability
Radicle's network protocol leaks private repositories without encryption.
In brief
Radicle's network protocol leaks private repositories without encryption. Radicle's network protocol exposes private repositories to attackers via unencrypted traffic and broken authentication, requiring immediate stop of private repository usage until a security update. Originally reported by Radicle.
Quick answers
- What happened?
- Two critical security vulnerabilities in Radicle's network protocol were reported.
- What is the issue?
- Network traffic between nodes is not encrypted and not authenticated, risking information leakage.
- What is the key takeaway from Radicle Network Protocol Vulnerability?
- Radicle's network protocol exposes private repositories to attackers via unencrypted traffic and broken authentication, requiring immediate stop of private repository usage until a security update.
What happened?
Two critical security vulnerabilities in Radicle's network protocol were reported.
Affected versions
All versions of Radicle released to date are vulnerable to the issues.
What is the issue?
Network traffic between nodes is not encrypted and not authenticated, risking information leakage.
Public vs private repositories
Information leakage is less concerning for public repositories but critical for private repositories.
User recommendations
Stop using private repositories until a security update is released to prevent leaks.
Fix timeline
The fix requires a major version update due to incompatibility with existing network protocols.
Vulnerability details
Peer authentication is broken, allowing attackers to impersonate nodes and access private repositories.
Realistic threat
Attackers on the network path between nodes can read data and fetch private repositories without detection.
Workaround steps
Block private repositories using rad block to prevent seeding until the security update is available.
Here's the gist
Radicle's network protocol exposes private repositories to attackers via unencrypted traffic and broken authentication, requiring immediate stop of private repository usage until a security update.
