GMS-2016-56: Insecure Defaults Leads to Potential MITM

July 29, 2016

ezseed-transmission downloads a script from http://stedolan.github.io/jq/download/linux64/jq without checking the certificate. An attacker on the same network or on an ISP level could intercept the traffic and push their own version of the file, causing the attackers code to be executed.

References

github.com/ezseed/transmission/commit/4816b1b08288774c607a7df2a4209612c4d46caa
github.com/ezseed/transmission/commit/71df46fa60979d117f04d0ae58dfdedde8c8f485

Detect and mitigate GMS-2016-56 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →