GHSA-2wrq-wmqf-8vcc

Source

https://github.com/advisories/GHSA-2wrq-wmqf-8vcc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-2wrq-wmqf-8vcc/GHSA-2wrq-wmqf-8vcc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2wrq-wmqf-8vcc

Aliases

CVE-2016-10565

Published

2019-02-18T23:35:48Z

Modified

2023-11-08T03:58:12.937904Z

Summary

Downloads Resources over HTTP in operadriver

Details

operadriver is a Opera Driver for Selenium.

operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.

Recommendation

Update to version 0.2.3 or later.

Database specific

{
    "nvd_published_at": null,
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-311"
    ],
    "github_reviewed_at": "2020-06-16T20:53:10Z",
    "github_reviewed": true
}

References

Affected packages

npm / operadriver

Package

Name: operadriver; View open source insights on deps.dev
Purl: pkg:npm/operadriver

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.2.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-2wrq-wmqf-8vcc/GHSA-2wrq-wmqf-8vcc.json"