GitHub Advisoryadvisory · npm
GHSA-9p47-w5xp-f4xr windows-build-tools downloads Resources over HTTP
HIGH
Official page ↗
- Aliases
- CVE-2017-16003
- Ecosystem
- npm
- Packages
- windows-build-tools
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-311
- Reviewed
- 2020-06-16
Affected packages
• npm windows-build-tools: < 1.0.0 → fixed in 1.0.0
Description
Affected versions of `windows-build-tools` insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-build-tools`.
Recommendation
Update to version 1.0.0 or later.
Related
Alias · CVE (1)
- CVE-2017-16003 windows-build-tools is a module for installing C++ Build Tools for Windows using npm. vulnerability
Weakness · CWE (1)
- CWE-311 Missing Encryption of Sensitive Data weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-16003 advisory
- https://github.com/felixrieseberg/windows-build-tools/commit/9835d33e68f2cb5e4d148e954bb3ed0221d98e90 web
- https://github.com/felixrieseberg/windows-build-tools/commit/9835d33e68f2cb5e4d148e954bb3ed0221d98e90) web
- https://github.com/advisories/GHSA-9p47-w5xp-f4xr advisory
- https://www.npmjs.com/advisories/304 web