GHSA-c4qp-h3m6-785f

Suggest an improvement
Source
https://github.com/advisories/GHSA-c4qp-h3m6-785f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-c4qp-h3m6-785f/GHSA-c4qp-h3m6-785f.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-c4qp-h3m6-785f
Aliases
Published
2019-02-18T23:51:59Z
Modified
2023-11-01T04:46:37.128913Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ibm_db downloads Resources over HTTP
Details

Affected versions of ibm_db insecurely download resources over HTTP.

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.

Recommendation

Update to version 1.0.2 or later.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-311"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:30:14Z"
}
References

Affected packages

npm / ibm_db

Package

Name
ibm_db
View open source insights on deps.dev
Purl
pkg:npm/ibm_db

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.2