CVE-2016-10697: Insecure Download of Executable in react-native-baidu-voice-synthesizer
Summary
CVE-2016-10697: Downloads Resources over HTTP in react-native-baidu-voice-synthesizer. Affects react-native-baidu-voice-synthesizer versions < 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
react-native-baidu-voice-synthesizer is an npm package that provides voice synthesis functionality for React Native applications. It allows developers to incorporate voice synthesis capabilities into their mobile applications. However, this package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of react-native-baidu-voice-synthesizer insecurely download an executable file, which can be intercepted and replaced by a malicious one if an attacker has a privileged network position. This could lead to code execution on the system running react-native-baidu-voice-synthesizer. The vulnerability is assigned CVE-2016-10697 and has a severity rating of HIGH. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-311.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the recommended workaround is to avoid using react-native-baidu-voice-synthesizer and opt for a different package that provides similar functionality. By doing so, you can mitigate the risk associated with this vulnerability.
Conclusion
In conclusion, react-native-baidu-voice-synthesizer is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can lead to code execution on the system if an attacker has a privileged network position. Currently, there is no patch available, and the best mitigation is to avoid using this package. Consider using an alternative package and take precautions while installing it on private networks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for react-native-baidu-voice-synthesizer →
FAQ
react-native-baidu-voice-synthesizer is an npm package that enables voice synthesis in React Native applications.
The vulnerability allows an attacker with a privileged network position to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running react-native-baidu-voice-synthesizer.
No, currently there is no patch available for this vulnerability.
To mitigate the risk, it is recommended to avoid using react-native-baidu-voice-synthesizer and consider using an alternative package. Additionally, ensure that the package is not installed while connected to a public network.
The vulnerability can be exploited by attackers who have a privileged network position, such as those who have compromised your network or have privileged access to your ISP.
