CVE-2016-10631: Insecure Download of Executable in jvminstall
Summary
CVE-2016-10631: Downloads Resources over HTTP in jvminstall. Affects jvminstall versions < 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jvminstall is an npm package that facilitates the installation of Java Virtual Machines (JVMs) on a system. It is designed to simplify the process of setting up and managing JVMs. However, this package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in jvminstall arises from the insecure download of an executable file. When the package attempts to download the executable, it does so over an unencrypted HTTP connection. This leaves the download susceptible to interception by an attacker who has a privileged network position. The attacker can replace the legitimate executable with a malicious one, leading to code execution on the system running jvminstall. This vulnerability poses a significant risk, particularly in scenarios where an attacker can compromise the network or has privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using jvminstall and choose a different package for JVM installation. Additionally, if jvminstall is already installed on a private network, it should not be used while connected to a public network.
Conclusion
The jvminstall package is vulnerable to an insecure download of an executable, which can lead to code execution on the system. It is recommended to avoid using this package and choose a more secure alternative. If jvminstall is already installed on a private network, precautions should be taken to minimize the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jvminstall →
FAQ
jvminstall is an npm package that simplifies the installation and management of Java Virtual Machines (JVMs) on a system.
The vulnerability in jvminstall is an insecure download of an executable over an unencrypted HTTP connection, which can be intercepted and replaced by a malicious executable.
The potential consequences include code execution on the system running jvminstall, which can be leveraged by an attacker who has compromised the network or has privileged access to the ISP.
No, there is currently no patch available for this vulnerability.
The risk of exploitation can be reduced by avoiding the use of jvminstall and opting for an alternative package. If jvminstall is already installed on a private network, it should not be used while connected to a public network.
