Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJ3cnEtd21xZi04dmNj

Downloads Resources over HTTP in operadriver

operadriver is a Opera Driver for Selenium.

operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.

Recommendation

Update to version 0.2.3 or later.

Permalink: https://github.com/advisories/GHSA-2wrq-wmqf-8vcc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJ3cnEtd21xZi04dmNj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 6 years ago
Updated: almost 2 years ago


Identifiers: GHSA-2wrq-wmqf-8vcc, CVE-2016-10565
References: Blast Radius: 0.0

Affected Packages

npm:operadriver
Dependent packages: 9
Dependent repositories: 641
Downloads: 248 last month
Affected Version Ranges: < 0.2.3
Fixed in: 0.2.3
All affected versions: 0.2.1, 0.2.2
All unaffected versions: 0.2.3, 1.0.0