What is GHSA-5g4r-87v2-jqvx?

GHSA-5g4r-87v2-jqvx is a security advisory published by GitHub Security Advisories with High severity. Downloads Resources over HTTP in apk-parser

Which CVE IDs does GHSA-5g4r-87v2-jqvx cover?

GHSA-5g4r-87v2-jqvx covers the following CVE IDs: CVE-2016-10564. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-5g4r-87v2-jqvx?

GHSA-5g4r-87v2-jqvx affects 1 product, including: npm/apk-parser:\u003c 0.1.6.

GHSA-5g4r-87v2-jqvxHigh

Downloads Resources over HTTP in apk-parser

Vendor

GitHub Security Advisories

Published

September 1, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2016-10564 →

📋 Description

apk-parser is a tool to extract Android Manifest info from an APK file.

apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.

Recommendation

Update to version 0.1.6 or later.

🎯 Affected products1

npm/apk-parser:< 0.1.6

🔗 References (3)

https://www.npmjs.com/advisories/195
https://nvd.nist.gov/vuln/detail/CVE-2016-10564
https://github.com/advisories/GHSA-5g4r-87v2-jqvx