CVE-2016-10534 SSL Validation Defaults to False in electron-packager
The tool defaults to disabling SSL verification, allowing attackers to perform man-in-the-middle attacks during package downloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10534?
CVE-2016-10534 is a medium-severity vulnerability in HackerOne electron-packager node module, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.
Weakness: CWE-295
Which versions are affected by CVE-2016-10534?
2 open source packages ship an affected version, including electron-packager. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
electron-packager npm | From 5.2.1 | 7.0.0 |
electron-packager npm | From 5.2.1 | 7.0.0 |
Products include Electron-Packager Project Electron-Packager.
How do I fix CVE-2016-10534?
Upgrade electron-packager to 7.0.0 or later.
Is CVE-2016-10534 being exploited?
There is no known exploitation of CVE-2016-10534 in the wild and no public exploit code.
Sources
Also known as GHSA-q43m-ffwr-rpcc.