CVE-2022-39199: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in immudb client SDKs (CVE-2022-39199) affecting versions <=1.4.0. The vulnerability relates to improper validation of server UUID, which is used by the client to distinguish between different server instances (GitHub Advisory).

The vulnerability stems from the immudb client SDK's failure to properly validate the server's UUID. The CVSS score for this vulnerability is 5.8 (Moderate), with the following metrics: Attack Vector: Network, Attack Complexity: High, Privileges Required: High, User Interaction: None, Scope: Changed, Confidentiality: None, Integrity: High, Availability: None (GitHub Advisory).

A malicious server can manipulate the reported UUID, deceiving the client into treating it as a different server. This allows the client to accept a state completely irrelevant to the one previously retrieved from the server, potentially compromising the integrity of the system (GitHub Advisory).

The vulnerability has been patched in version 1.4.1 of the Go SDK. As a workaround, users can initialize an immudb client object with a custom state handler to store the state. By implementing a custom handler that ignores the server UUID, clients can ensure consistent server identification even if the server changes its UUID (GitHub Release, GitHub Advisory).