CVE-2016-10656: Insecure Download of Resources in qbs
Summary
CVE-2016-10656: Downloads Resources over HTTP in qbs. Affects qbs versions < 1.4.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qbs is an npm package used for building projects. It provides a high-level build system that is extensible and supports multiple platforms. However, versions of qbs prior to 1.4.3 are vulnerable to an insecure download of resources over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of qbs insecurely download an executable over an unencrypted HTTP connection. This means that if an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This could result in code execution on the system running qbs. The vulnerability has a high severity rating and is classified as CWE-311.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In summary, the qbs package has a vulnerability that allows for insecure download of resources over an unencrypted HTTP connection. This can lead to code execution if an attacker intercepts and replaces the downloaded executable. It is recommended to avoid using the qbs package and choose an alternative if possible. If you have further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qbs →
FAQ
qbs is an npm package used for building projects. It provides a high-level build system that is extensible and supports multiple platforms.
The impact of this vulnerability is that an attacker with a privileged network position can intercept the download of an executable and replace it with a malicious one, potentially leading to code execution on the system running qbs.
No, there is currently no patch available for this vulnerability.
To mitigate the risk of exploitation, it is recommended to avoid using the qbs package and choose an alternative if possible. If you must use qbs, ensure that it is not installed while connected to a public network.
Only individuals who have compromised your network or have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees, can exploit this vulnerability.
