CVE-2016-10563 Downloads Resources over HTTP in go-ipfs-dep
Insecure HTTP downloads during installation allow MITM attackers to compromise module integrity and potentially execute code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10563?
CVE-2016-10563 is a high-severity vulnerability in HackerOne go-ipfs-dep node module, published on 31 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
Which versions are affected by CVE-2016-10563?
2 open source packages ship an affected version, including go-ipfs-dep. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
go-ipfs-dep npm | All versions | 0.4.4 |
go-ipfs-dep npm | All versions | 0.4.4 |
Products include Ipfs Go-Ipfs-Dep.
How do I fix CVE-2016-10563?
Upgrade go-ipfs-dep to 0.4.4 or later.
Is CVE-2016-10563 being exploited?
There is no known exploitation of CVE-2016-10563 in the wild and no public exploit code.
Sources
Also known as GHSA-g3xp-v2ff-x5c3.