Downloads Resources over HTTP in go-ipfs-dep

Affected versions of go-ipfs-deps insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the...

beaker-plugin-ipfs (>=1.0.0, <=2.0.1), go-ipfs (>=0.4.0-hacky2, <=0.4.3-npmfix1) +2 more potentially affected by CVE-2016-10563 via go-ipfs-dep (>=0.4.0-1, <=0.4.3-2)

go-ipfs-dep NPM version =0.4.0-1, =1.0.0, =0.4.0-hacky2, =0.9.0, =1.0.0, =1.6.0 Source cves: CVE-2016-10563 Source advisory: GHSA-G3XP-V2FF-X5C3...

CVE-2016-10563

During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise...

Design/Logic Flaw

During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise...

CVE-2016-10563

During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise...

CVE-2016-10563

During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise...

CVE-2016-10563

CVE-2016-10563 concerns the go-ipfs-deps package, where versions before 0.4.4 download resources over HTTP. The root cause is insecure HTTP downloads that enable a MITM attacker to modify or read resources, compromising integrity and potentially enabling further impact, including remote code exec...

beaker-plugin-ipfs (>=1.0.0, <=2.0.1), go-ipfs (>=0.4.1-hacky2, <=0.4.3-npmfix1) +2 more potentially affected by CVE-2016-10563 via go-ipfs-dep (>=0.4.1, <=0.4.3-2)

go-ipfs-dep NPM version =0.4.1, =1.0.0, =0.4.1-hacky2, =0.12.0, =1.0.0, =1.6.0 Source cves: CVE-2016-10563 Source advisory: MEND:CVE-2016-10563...

PT-2018-4741

Name of the Vulnerable Software and Affected Versions go-ipfs-deps versions prior to 0.4.4 Description The issue allows for a MITM attack to compromise the integrity of the resources used by the go-ipfs-deps module, potentially leading to further compromise. In scenarios where an attacker has a...

CVE-2016-10563: Missing Encryption of Sensitive Data

During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise...

Arbitrary Redirects

github.com/ipfs/go-ipfs is vulnerable to arbitrary redirects. There is no validation of the X-Ipfs-Path-Prefix header which allows attackers to pass in arbitrary prefixes resulting in arbitrary redirects and directory listings...

Man In The Middle (MitM)

go-ipfs-dep is vulnerable to man-in-the-middle MitM attacks. This is because the library downloads binaries via HTTP, allowing MitM attacks. It may also cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or...