CVE-2016-10575: Insecure Download of Executable in kindlegen
Summary
CVE-2016-10575: Downloads Resources over HTTP in kindlegen. Affects kindlegen versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
kindlegen is an npm package used for generating Kindle eBooks. It provides a command-line tool that converts various file formats into the Kindle eBook format. The package is widely used by developers and publishers to create eBooks compatible with Kindle devices and applications. However, certain versions of kindlegen have a vulnerability that allows an attacker with privileged network position to intercept and replace the executable downloaded by kindlegen with a malicious one.
Vulnerability Detail
The vulnerability in kindlegen arises from insecurely downloading an executable over an unencrypted HTTP connection. When kindlegen fetches the executable from a remote server, it does not use secure protocols like HTTPS, making it susceptible to interception and tampering. If an attacker successfully intercepts the response, they can replace the legitimate executable with a malicious one. When the user runs kindlegen, the compromised executable will execute on their system, potentially leading to arbitrary code execution.
How To Fix
Minimum fixed version
1.1.0
This is the first release that contains the fix.
npm install kindlegen@1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
kindlegen versions prior to 1.1.0 are vulnerable to an insecure download of an executable, which can be intercepted and replaced by an attacker. To mitigate this vulnerability, it is crucial to update kindlegen to version 1.1.0 or higher. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kindlegen →
FAQ
kindlegen is an npm package used for generating Kindle eBooks. It converts various file formats into the Kindle eBook format.
If an attacker intercepts and replaces the executable downloaded by kindlegen, they can execute arbitrary code on the system running kindlegen.
Updating kindlegen to version 1.1.0 or higher will fix the vulnerability by ensuring secure downloads over HTTPS.
No, only versions prior to 1.1.0 are affected. Updating to version 1.1.0 or higher resolves the vulnerability.
No, the recommended solution is to update kindlegen to a secure version.
