Bug 1584935 (CVE-2016-10578) - CVE-2016-10578 nodejs-unicode: Downloads resources over HTTP
Summary: CVE-2016-10578 nodejs-unicode: Downloads resources over HTTP
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2016-10578
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1584936 1584937
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-06-01 01:11 UTC by Sam Fowler
Modified: 2021-02-17 00:12 UTC (History)
1 user (show)

Fixed In Version: nodejs-unicode 9.0.0
Clone Of:
Environment:
Last Closed: 2018-08-14 16:01:01 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-06-01 01:11:33 UTC 
nodejs-unicode before version 9.0.0 insecurely download resources over HTTP.

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


External Reference:

https://nodesecurity.io/advisories/161
Comment 1 Sam Fowler 2018-06-01 01:16:12 UTC 
Created nodejs-unicode-7.0.0 tracking bugs for this issue:

Affects: epel-all [bug 1584936]
Affects: fedora-all [bug 1584937]
Comment 2 Parag Nemade 2018-07-25 13:09:08 UTC 
This module is just unicode-7.0.0 module. Its upstream has changed the way releases should happen. previously they were released as per Unicode version per module project but now they moved to unique project https://www.npmjs.com/package/unicode which I have no plan to package currently.

Hence, I have retired this package in Fedora and EPEL. The dependent package nodejs-langdetect has also been retired.
Note You need to log in before you can comment on or make changes to this bug.