CVE-2016-10658: Insecure Download of Executable in native-opencv
Summary
CVE-2016-10658: Downloads Resources over HTTP in native-opencv. Affects native-opencv versions < 3.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
native-opencv is an npm package that provides bindings for the OpenCV library, allowing developers to use OpenCV functionality in Node.js applications. It is commonly used for computer vision tasks such as image and video processing. However, versions of native-opencv prior to 3.0.0 have a vulnerability that allows an attacker to download an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in native-opencv arises from insecurely downloading an executable over an unencrypted HTTP connection. If an attacker has a privileged network position, they can intercept the response and replace the executable with a malicious one. This can lead to code execution on the system running native-opencv. The package has not received updates since 2015, and no patch is currently available.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The best course of action is to follow the recommended steps for fixing the vulnerability.
Conclusion
The native-opencv package has a vulnerability that allows an attacker to download and replace an executable over an unencrypted HTTP connection. This can lead to code execution on the system running native-opencv. It is recommended to avoid using this package and consider using an alternative. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for native-opencv →
FAQ
native-opencv is an npm package that provides bindings for the OpenCV library, allowing developers to use OpenCV functionality in Node.js applications.
The vulnerability allows an attacker to download and replace an executable, potentially leading to code execution on the system running native-opencv.
No, there is currently no patch available for this vulnerability.
The package has not received updates since 2015.
Avoid using native-opencv and consider using an alternative package. If native-opencv is already installed on a private network, ensure it is not installed while connected to a public network.
