CVE-2016-10558: Insecure Download of Resources in aerospike
Summary
CVE-2016-10558: Downloads Resources over HTTP in aerospike. Affects aerospike versions < 2.4.2. Fixed in 2.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aerospike is an npm package that provides functionality for interacting with the Aerospike database. It allows users to perform various operations such as storing, retrieving, and managing data in the Aerospike database. This package is vulnerable to an insecure download of resources issue.
Vulnerability Detail
The affected versions of aerospike insecurely download an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This can lead to code execution on the system running aerospike.
How To Fix
Minimum fixed version
2.4.2
This is the first release that contains the fix.
npm install aerospike@2.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In summary, the aerospike package is vulnerable to an insecure download of resources issue. To fix this vulnerability, it is recommended to update to version 2.4.2 or later. There are no known workarounds for this issue. If you have any further questions or need assistance with vulnerability remediation, please reach out to DevNack.com.
See every vulnerability recorded for aerospike →
FAQ
The impact of this vulnerability is that an attacker can replace the downloaded executable with a malicious one, leading to code execution on the system running aerospike.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will alert you if the vulnerability is present.
There are no known exploits for this vulnerability at the moment. However, it is still important to update to the latest version of aerospike to mitigate the risk.
You can find more information about this vulnerability in the advisory published on GitHub at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-v5v3-8jqf-vg27/GHSA-v5v3-8jqf-vg27.json
For further support on vulnerability remediation, you can contact info@devnack.com.
