GitHub Advisoryadvisory · npm

GHSA-g3xp-v2ff-x5c3 Downloads Resources over HTTP in go-ipfs-dep

HIGH Published 2019-02-18 Modified 2020-08-31 Official page ↗
Aliases
CVE-2016-10563
Ecosystem
npm
Packages
go-ipfs-dep
Severity
High
Weaknesses
CWE-311
Reviewed
2020-06-16

Affected packages

• npm go-ipfs-dep: < 0.4.4 → fixed in 0.4.4

Description

Affected versions of `go-ipfs-deps` insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution. Recommendation Update to version 0.4.4 or later.

Related

Alias · CVE (1)

  • CVE-2016-10563 During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References