asez (>=0.0.0, <=0.0.1) potentially affected by CVE-2016-10558 via aerospike (2.4.1)

aerospike NPM version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on aerospike and may be impacted: - asez =0.0.0, =0.0.1 Source cves: CVE-2016-10558 Source advisory: OSV:GHSA-V5V3-8JQF-VG27...

CVE-2016-10558

The vulnerability CVE-2016-10558 affects the Aerospike Node.js addon. Versions below 2.4.2 download binary resources over HTTP, allowing a privileged network attacker to perform a MITM and swap the binary, potentially leading to remote code execution on the host running aerospike. The issue is tr...