Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVnNHItODd2Mi1qcXZ4

Downloads Resources over HTTP in apk-parser

apk-parser is a tool to extract Android Manifest info from an APK file.

apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.

Recommendation

Update to version 0.1.6 or later.

Permalink: https://github.com/advisories/GHSA-5g4r-87v2-jqvx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTVnNHItODd2Mi1qcXZ4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: about 2 years ago

EPSS Percentage: 0.00606
EPSS Percentile: 0.78508

Identifiers: GHSA-5g4r-87v2-jqvx, CVE-2016-10564
References:

Blast Radius: 0.0

Affected Packages

npm:apk-parser

Dependent packages: 4
Dependent repositories: 8
Downloads: 139 last month
Affected Version Ranges: < 0.1.6
Fixed in: 0.1.6
All affected versions: 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5
All unaffected versions: 0.1.6, 0.1.7