Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc2OWMtcXBoaC1nM3dt

Downloads Resources over HTTP in macaca-chromedriver

Affected versions of macaca-chromedriver insecurely download an executable over an unencrypted HTTP connection.

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running macaca-chromedriver.

Recommendation

Update to version 1.0.29 or later.

Permalink: https://github.com/advisories/GHSA-769c-qphh-g3wm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTc2OWMtcXBoaC1nM3dt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 6 years ago
Updated: almost 2 years ago

EPSS Percentage: 0.00494
EPSS Percentile: 0.75964

Identifiers: GHSA-769c-qphh-g3wm, CVE-2016-10586
References:

Blast Radius: 0.0

Affected Packages

npm:macaca-chromedriver

Dependent packages: 8
Dependent repositories: 8
Downloads: 1,117 last month
Affected Version Ranges: < 1.0.29
Fixed in: 1.0.29
All affected versions: 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28
All unaffected versions: 1.0.29, 1.0.30, 1.0.31, 1.0.34, 1.0.35, 1.0.36, 1.0.37, 1.0.38, 1.0.39, 1.0.40, 1.0.41, 1.0.42, 1.0.43, 1.0.44, 1.0.45, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.6, 1.2.7, 1.2.8, 1.2.9, 1.2.10, 1.2.11, 1.2.13, 1.2.14, 1.2.16