CVE-2016-10933 Source code is downloaded over cleartext HTTP in portaudio
Attackers can inject malicious code into the portaudio Rust crate via man-in-the-middle attacks during cleartext HTTP source downloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-10933?
CVE-2016-10933 is a medium-severity vulnerability in n/a, published on 26 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.
Weakness: CWE-254
Which versions are affected by CVE-2016-10933?
3 open source packages ship an affected version, including portaudio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
portaudio crates.io | All versions to 0.7.0 | None |
portaudio crates.io | All versions to 0.7.0 | None |
portaudio crates.io | From 0.0.0-0 | None |
Products include Portaudio Project Portaudio.
How do I fix CVE-2016-10933?
No fix has been published for CVE-2016-10933 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-10933 being exploited?
There is no known exploitation of CVE-2016-10933 in the wild and no public exploit code.
Sources
Also known as GHSA-pq6v-x7gp-7776, RUSTSEC-2016-0003.