GitHub Advisoryadvisory · npm

GHSA-c4qp-h3m6-785f ibm_db downloads Resources over HTTP

HIGH Published 2019-02-18 Modified 2023-09-07 Official page ↗
Aliases
CVE-2016-10577
Ecosystem
npm
Packages
ibm_db
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-311
Reviewed
2020-06-16

Affected packages

• npm ibm_db: < 1.0.2 → fixed in 1.0.2

Description

Affected versions of `ibm_db` insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution. Recommendation Update to version 1.0.2 or later.

Related

Alias · CVE (1)

  • CVE-2016-10577 ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References