Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwNjktZ3hwbS01NDY5

Downloads Resources over HTTP in alto-saxophone

Affected versions of alto-saxophone insecurely download an executable over an unencrypted HTTP connection.

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running alto-saxophone.

Recommendation

Update to version 2.25.1 or later.

Permalink: https://github.com/advisories/GHSA-2p69-gxpm-5469
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwNjktZ3hwbS01NDY5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 5 years ago
Updated: over 1 year ago

Identifiers: GHSA-2p69-gxpm-5469, CVE-2016-10694
References:

Blast Radius: 0.0

Affected Packages

npm:alto-saxophone

Dependent packages: 2
Dependent repositories: 12
Downloads: 153 last month
Affected Version Ranges: < 2.25.1
Fixed in: 2.25.1
All affected versions: 2.20.0, 2.21.0, 2.22.0, 2.23.0, 2.23.1, 2.24.0, 2.25.0
All unaffected versions: 2.25.1, 2.26.0, 2.27.0, 2.28.0, 2.29.0, 2.30.0, 2.31.0, 2.31.1, 2.32.0, 2.33.0, 2.34.0, 2.35.0, 2.36.0, 2.37.0, 2.38.0, 2.39.0, 2.40.0, 2.41.0, 2.42.0, 2.43.0, 2.43.1, 2.44.0