CVE-2016-10582: Insecure Download of Resources in closurecompiler
Summary
CVE-2016-10582: closurecompiler downloads Resources over HTTP. Affects closurecompiler versions < 1.6.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
closurecompiler is an npm package that provides a JavaScript optimizing compiler. It is commonly used to minify and optimize JavaScript code. The package allows developers to improve the performance and efficiency of their JavaScript applications. However, versions of closurecompiler prior to 1.6.1 are vulnerable to an insecure download of resources over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in closurecompiler arises from the insecure download of an executable file over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could lead to code execution on the system running closurecompiler. The vulnerability has a high severity rating and is classified under CWE-311.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, closurecompiler versions prior to 1.6.1 are vulnerable to an insecure download of resources over an unencrypted HTTP connection. To mitigate this vulnerability, it is crucial to update to version 1.6.1 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for closurecompiler →
FAQ
closurecompiler is an npm package that provides a JavaScript optimizing compiler. It is used to minify and optimize JavaScript code for improved performance and efficiency.
The vulnerability allows an attacker with a privileged network position to intercept and replace the executable downloaded by closurecompiler. This could result in code execution on the system running closurecompiler.
Updating closurecompiler to version 1.6.1 or later ensures that resources are downloaded securely over an encrypted HTTPS connection, reducing the risk of interception and code execution.
No workaround is available for this vulnerability. It is recommended to update to the latest version of closurecompiler.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-hjgp-8ffr-hwwr/GHSA-hjgp-8ffr-hwwr.json
