GHSA-q43m-ffwr-rpcc

Source

https://github.com/advisories/GHSA-q43m-ffwr-rpcc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-q43m-ffwr-rpcc/GHSA-q43m-ffwr-rpcc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q43m-ffwr-rpcc

Aliases

CVE-2016-10534

Published

2019-02-18T23:58:24Z

Modified

2023-11-08T03:58:11Z

Summary

SSL Validation Defaults to False in electron-packager

Details

Affected versions of electron-packager configure the generated application to disable SSL certificate verification by default.

This could allow an attacker with a privileged network position to launch a Man In The Middle (MITM) attack on the install process, intercepting the step where electron-packager downloads Electron for supported target platforms and architectures, and replacing the valid download with a tampered malicious one.

This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.

Recommendation

Update to version 7.0.0 or later.
Delete the electron-download cache folder, which is by default located at ~/.electron.

Database specific

{
    "cwe_ids": [
        "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:50:47Z",
    "nvd_published_at": null,
    "severity": "LOW"
}

References

Affected packages

npm / electron-packager

Package

Name: electron-packager; View open source insights on deps.dev
Purl: pkg:npm/electron-packager

Affected ranges

Type: SEMVER
Events: Introduced

5.2.1

Fixed

7.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-q43m-ffwr-rpcc/GHSA-q43m-ffwr-rpcc.json"