GitHub Advisoryadvisory · npm

GHSA-q43m-ffwr-rpcc SSL Validation Defaults to False in electron-packager

LOW Published 2019-02-18 Modified 2021-01-08 Official page ↗
Aliases
CVE-2016-10534
Ecosystem
npm
Packages
electron-packager
Severity
Low
Weaknesses
CWE-295
Reviewed
2020-06-16

Affected packages

• npm electron-packager: >= 5.2.1, < 7.0.0 → fixed in 7.0.0

Description

Affected versions of `electron-packager` configure the generated application to disable SSL certificate verification by default. This could allow an attacker with a privileged network position to launch a Man In The Middle (MITM) attack on the install process, intercepting the step where electron-packager downloads Electron for supported target platforms and architectures, and replacing the valid download with a tampered malicious one. This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API. Recommendation 1. Update to version 7.0.0 or later. 2. Delete the `electron-download` cache folder, which is by default located at `~/.electron`.

Related

Alias · CVE (1)

  • CVE-2016-10534 electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References