PT-2016-4589 · Rust · Portaudio

Publicado 2016-08-01 · Atualizado 2021-08-25 · CVE-2016-10933

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions portaudio crate versions prior to 0.7.1

Description The issue concerns a man-in-the-middle problem due to the use of cleartext HTTP for downloading the source code. This allows an attacker to intercept the download and potentially achieve remote code execution (RCE) by replacing the original source code with a malicious archive.

Recommendations For portaudio crate versions prior to 0.7.1, update to version 0.7.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the build script that downloads the portaudio source over HTTP until a secure version is available. Avoid using the build script in untrusted networks to minimize the risk of exploitation.

Correção

Cleartext Transmission of Sensitive Information

Enumeração de Fraquezas

CWE-319

CWE-254

Identificadores relacionados

CVE-2016-10933

GHSA-PQ6V-X7GP-7776

RUSTSEC-2016-0003

Produtos afetados

Portaudio

Referências · 8

• https://github.com/RustAudio/rust-portaudio · Nota
• https://github.com/RustAudio/rust-portaudio/issues/144 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10933 · Nota de Segurança
• https://rustsec.org/advisories/RUSTSEC-2016-0003.html · Nota
• https://osv.dev/vulnerability/RUSTSEC-2016-0003 · Aviso do Fabricante
• https://crates.io/crates/portaudio · Nota
• https://osv.dev/vulnerability/CVE-2016-10933 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-pq6v-x7gp-7776 · Aviso do Fabricante