CVE-2016-10563: Insecure Resource Downloads in go-ipfs-dep
Summary
CVE-2016-10563: Downloads Resources over HTTP in go-ipfs-dep. Affects go-ipfs-dep versions < 0.4.4. Fixed in 0.4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-ipfs-dep is an npm package that is used as a dependency in the go-ipfs project. It provides resources and functionality for the go-ipfs project to function properly. However, this package is vulnerable to insecure resource downloads over HTTP.
Vulnerability Detail
The vulnerability in go-ipfs-dep allows an attacker with a privileged network position to modify or read resources that are downloaded insecurely over HTTP. The severity of the impact depends on the behavior of the package, ranging from sensitive information exposure to potential remote code execution.
How To Fix
Minimum fixed version
0.4.4
This is the first release that contains the fix.
npm install go-ipfs-dep@0.4.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, go-ipfs-dep is vulnerable to insecure resource downloads over HTTP. It is recommended to update to version 0.4.4 or later to fix this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for go-ipfs-dep →
FAQ
go-ipfs-dep is an npm package used as a dependency in the go-ipfs project. It provides necessary resources and functionality for go-ipfs to work.
The impact can vary depending on the behavior of the package, but it can range from exposure of sensitive information to potential remote code execution.
You can fix this vulnerability by updating go-ipfs-dep to version 0.4.4 or later.
No specific workarounds have been mentioned for this vulnerability.
You can find more information about this vulnerability in the advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-g3xp-v2ff-x5c3/GHSA-g3xp-v2ff-x5c3.json
