Description
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
Remediation
References
https://nodesecurity.io/advisories/156
https://github.com/diasdavid/go-ipfs-dep/pull/12
Related Vulnerabilities
CVE-2017-16208 Vulnerability in npm package dmmcquay.lab6
CVE-2016-3092 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2019-10428 Vulnerability in maven package org.jenkins-ci.plugins:aqua-security-scanner
CVE-2020-15125 Vulnerability in npm package auth0
CVE-2023-37914 Vulnerability in maven package org.xwiki.platform:xwiki-platform-invitation-ui