chromedriver Downloads Resources over HTTP

Description

Affected versions of chromedriver insecurely download resources over HTTP.

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary file, replacing it with a malicious one.

Recommendation

Update the chromedriver package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.25.2
• Patched version(s): 2.25.2

References

• GHSA-jh5w-6964-x5cf
• CVE-2016-10579
• CWE-311
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• appium-chromedriver downloads Resources over HTTP - CVE-2016-10557
• Downloads Resources over HTTP in baryton-saxophone - CVE-2016-10573
• Downloads Resources over HTTP in product-monitor - CVE-2016-10567
• Downloads Resources over HTTP in wasdk - CVE-2016-10587

Tags:

npm

chromedriver