CVE-2016-10576: Insecure Download of Resources in fuseki
Summary
CVE-2016-10576: fuseki downloads Resources over HTTP. Affects fuseki versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fuseki is an npm package that provides a SPARQL server and triple store. It allows users to query and manipulate RDF data. The package is commonly used in applications that require RDF data storage and retrieval. However, versions of fuseki prior to 1.0.1 are vulnerable to an insecure download of resources over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in fuseki arises from the insecure download of an executable file over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could result in code execution on the system running fuseki, potentially leading to further compromise of the system.
How To Fix
Minimum fixed version
1.0.1
This is the first release that contains the fix.
npm install fuseki@1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to a fixed version of fuseki.
Conclusion
In summary, fuseki versions prior to 1.0.1 are vulnerable to an insecure download of resources over an unencrypted HTTP connection. To mitigate this vulnerability, it is crucial to update to version 1.0.1 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for fuseki →
FAQ
Fuseki is an npm package that provides a SPARQL server and triple store for querying and manipulating RDF data.
The vulnerability allows an attacker with a privileged network position to replace downloaded resources with malicious ones, potentially leading to code execution on the system running fuseki.
To fix this vulnerability, update fuseki to version 1.0.1 or later, which uses secure HTTPS connections for resource downloads.
There are no specific workarounds mentioned for this vulnerability. Updating to a fixed version is the recommended solution.
For more information about this vulnerability, you can refer to the GitHub advisory database: [link to advisory]
