Description
During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.
Remediation
References
https://nodesecurity.io/advisories/156
https://github.com/diasdavid/go-ipfs-dep/pull/12
Related Vulnerabilities
CVE-2021-23663 Vulnerability in npm package sey
CVE-2019-1003064 Vulnerability in maven package org.jenkins-ci.plugins:aws-device-farm
CVE-2017-15089 Vulnerability in maven package org.infinispan:infinispan-commons
CVE-2021-3803 Vulnerability in npm package nth-check
CVE-2022-23505 Vulnerability in npm package passport-wsfed-saml2