CVE-2016-10630: Insecure Resource Download in install-g-test
Summary
CVE-2016-10630: Downloads Resources over HTTP in install-g-test. Affects install-g-test versions < 2.0.12. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The install-g-test package is an npm package used for installing and managing Google Test, a C++ testing framework. It allows developers to easily set up and run unit tests for their C++ projects. However, this package is vulnerable to an insecure resource download issue.
Vulnerability Detail
The vulnerability in install-g-test arises from insecurely downloading resources over HTTP. This means that when the package attempts to download resources, it does so without using a secure HTTPS connection. If an attacker has a privileged network position, they can intercept and modify these resources, potentially leading to various security risks. The severity of the impact depends on the behavior of the package, ranging from unauthorized access to sensitive information to remote code execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The install-g-test package is vulnerable to an insecure resource download issue, which can have varying degrees of impact depending on the package's behavior. It is recommended to avoid using this package and consider alternative options. If you still choose to use it, take precautions to reduce the risk of exploitation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for install-g-test →
FAQ
The impact can vary depending on the behavior of the package, but it can range from unauthorized access to sensitive information to remote code execution.
No, there is currently no patch available for this vulnerability.
It is recommended to avoid using this package and look for alternative packages if possible.
If you must use the install-g-test package, avoid installing it while connected to a public network. If installed on a private network, only individuals who have compromised your network or have privileged access to your ISP can exploit the vulnerability.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-qjvf-rmwg-64fr/GHSA-qjvf-rmwg-64fr.json
