GitHub Advisoryadvisory · npm

GHSA-5g4r-87v2-jqvx Downloads Resources over HTTP in apk-parser

HIGH Published 2020-09-01 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10564
Ecosystem
npm
Packages
apk-parser
Severity
High
Weaknesses
CWE-311
Reviewed
2020-08-31

Affected packages

• npm apk-parser: < 0.1.6 → fixed in 0.1.6

Description

apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. Recommendation Update to version 0.1.6 or later.

Related

Alias · CVE (1)

  • CVE-2016-10564 apk-parser is a tool to extract Android Manifest info from an APK file. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References