PT-2018-4851 · Ipip · Ipip-Coffee

Published 2018-06-04 · Updated 2019-10-09 · CVE-2016-10673

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ipip-coffee (affected versions not specified)

Description The issue affects the integrity and availability of geolocation data used by applications. It occurs because ipip-coffee downloads geolocation resources over HTTP, making it susceptible to Man-In-The-Middle (MITM) attacks. In such attacks, an adversary with a privileged network position can modify or read the resources at will, impacting the data's integrity and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a mitigation measure, consider avoiding the use of this package and opt for a different package if available. Alternatively, reduce the risk of exploitation by ensuring this package is not installed while connected to a public network.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-310

CWE-311

Related Identifiers

CVE-2016-10673

GHSA-M8PW-H8QJ-RGJ9

Affected Products

Ipip-Coffee

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-10673 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10673 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m8pw-h8qj-rgj9 · Vendor Advisory
• https://npmjs.com/advisories/279 · Note
• https://github.com/advisories/GHSA-m8pw-h8qj-rgj9 · Note
• https://nodesecurity.io/advisories/279 · Note