PT-2018-4741 · Ipfs · Go-Ipfs-Deps

Scott113341 · Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10563

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions go-ipfs-deps versions prior to 0.4.4

Description The issue allows for a MITM attack to compromise the integrity of the resources used by the go-ipfs-deps module, potentially leading to further compromise. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. The impact ranges from being able to read sensitive information to remote code execution.

Recommendations Update to version 0.4.4 or later.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-310

CWE-311

Identificadores relacionados

CVE-2016-10563

GHSA-G3XP-V2FF-X5C3

Produtos afetados

Go-Ipfs-Deps

Referências · 7

• https://github.com/diasdavid/go-ipfs-dep/pull/12 · Nota
• https://osv.dev/vulnerability/CVE-2016-10563 · Aviso do Fabricante
• https://nodesecurity.io/advisories/156 · Nota
• https://osv.dev/vulnerability/GHSA-g3xp-v2ff-x5c3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10563 · Nota de Segurança
• https://github.com/advisories/GHSA-g3xp-v2ff-x5c3 · Nota
• https://npmjs.com/advisories/156 · Nota