lix-pm/lix.client · Security
Machine-In-The-Middle in lix
- GHSA ID
- GHSA-q8xg-8xwf-m598
- CVE ID
- CVE-2020-10800
- Severity
- high
- Published
- Updated
- CVSS
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
All versions of lix are vulnerable to Machine-In-The-Middle. The package accepts downloads with http and follows location header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
CWEs
- CWE-544 · Missing Standardized Error Handling Mechanism
- CWE-639 · Authorization Bypass Through User-Controlled Key