CVE-2016-10565 Downloads Resources over HTTP in operadriver
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2016-10565?
CVE-2016-10565 is a high-severity vulnerability in HackerOne operadriver node module, published on 31 May 2018.
Official description
operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
Which versions are affected by CVE-2016-10565?
2 open source packages ship an affected version, including operadriver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
operadriver npm | All versions | 0.2.3 |
operadriver npm | All versions | 0.2.3 |
Products include Cnpmjs Operadriver.
How do I fix CVE-2016-10565?
Upgrade operadriver to 0.2.3 or later.
Is CVE-2016-10565 being exploited?
There is no known exploitation of CVE-2016-10565 in the wild and no public exploit code.
Sources
Also known as GHSA-2wrq-wmqf-8vcc.