CVE-2016-10563

State: Published
Severity: Not scored
Published: May 31, 2018
Updated: Sep 16, 2024
Reserved: Oct 29, 2017

Description

During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.

Scores

The record has no CVSS score.

Weaknesses

CWE-311 Missing Encryption of Sensitive Data (CWE-311)

Affected Products

Product	Versions
go-ipfs-dep node moduleHackerOne	<0.4.4Affected

References

https://nodesecurity.io/advisories/156
https://github.com/diasdavid/go-ipfs-dep/pull/12

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.