Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRwN2otNXBweC1yZmht

Downloads Resources over HTTP in apk-parser3

Affected versions of apk-parser3 insecurely download an executable over an unencrypted HTTP connection.

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running apk-parser3.

Recommendation

Update to version 0.1.3 or greater.

Permalink: https://github.com/advisories/GHSA-4p7j-5ppx-rfhm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTRwN2otNXBweC1yZmht
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: about 2 years ago


EPSS Percentage: 0.00606
EPSS Percentile: 0.78508

Identifiers: GHSA-4p7j-5ppx-rfhm, CVE-2016-10574
References: Blast Radius: 0.0

Affected Packages

npm:apk-parser3
Dependent packages: 6
Dependent repositories: 2
Downloads: 160 last month
Affected Version Ranges: < 0.1.3
Fixed in: 0.1.3
All affected versions: 0.1.1, 0.1.2
All unaffected versions: 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7