Radicle: Disclosure of Vulnerability in the Network Protocol
Radicle discloses critical protocol flaws allowing network eavesdropping and impersonation, compromising all private repositories in transit.
Radicle, a peer-to-peer code collaboration platform, disclosed two critical vulnerabilities in its network protocol. The flaws allow unencrypted data transmission and peer impersonation, enabling attackers on the network path to read and exfiltrate private repositories. The project advises users to stop using private repositories over the network until a breaking protocol update is released.
- Radicle discloses two critical network protocol vulnerabilities.
- Traffic between nodes is not encrypted or authenticated, allowing eavesdropping.
- Peer authentication is broken, enabling impersonation of allow-listed nodes.
- A fix requires a breaking protocol change; users must stop using private repos.
- Vulnerabilities allow full exfiltration of private repositories on the network path.
From the original article
5 min read at radicle.dev
Two critical security vulnerabilities in the network protocol used by Radicle nodes were reported. All versions of Radicle that were released to date are vulnerable. Network traffic between nodes is not encrypted and not authenticated.
By radicle.dev via tuxes · radicle.dev
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.