CVE-2021-4258: Cleartext Transmission of Sensitive Information (CWE-319)
value: A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package Information Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be initiated remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 667c3e2e9178f15c23d7918b5db25cd0792c8472. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216251. NOTE: Most sources redirect to the encrypted site which limits the possibilities of an attack.
CWE description: The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CVSS v3 base score: 7.5
Published: 2022-12-19T14:15Z
Repository: https://github.com/whohas/whohas
Language: Other
Files changed: whohas
Commit date: 2021-11-02 09:48:32 +0800
Commit message: Use https when checking package information

Prevents network attackers from manipulating the displayed information.

Stick to http for Mandriva and SourceMage,
since they don't appear to support https.

Diff: diff --git a/whohas b/whohas
index 2873cd6..4d65a7b 100755
--- a/whohas
+++ b/whohas
@@ -185,11 +185,11 @@ sub maxthreads {
 		return $cpucount < $jobcount ? $cpucount : $jobcount;
 	}
 }
 
 sub fedora {
-	my $baseurl = "http://dl.fedoraproject.org/pub/fedora/linux/releases/";
+	my $baseurl = "https://dl.fedoraproject.org/pub/fedora/linux/releases/";
 	my $distroname = "Fedora";
 	my $arch = "x86_64";
 	my $searchy = $_[0];
 	my @names;
 	my @versions;
@@ -259,11 +259,11 @@ sub month_to_digits {
 	$_[0] =~ s/DEC/12/i;
 	return ($_[0]);
 }
 
 sub macports {
-	my $baseurl = "http://www.macports.org";
+	my $baseurl = "https://www.macports.org";
 	my @names;
 	my @versions;
 	my @dates;
 	my @sizes;
 	my @repos;
@@ -289,11 +289,11 @@ sub macports {
 	return ();
 }
 
 
 sub fink {
-	my $baseurl = "http://pdb.finkproject.org/pdb/";
+	my $baseurl = "https://pdb.finkproject.org/pdb/";
 	my @names;
 	my @versions;
 	my @dates;
 	my @sizes;
 	my @repos;
@@ -386,11 +386,11 @@ sub size_trim {
 	return $retval;
 }
 
 
 sub freebsd {
-	my $query = "http://www.freebsd.org/cgi/ports.cgi?query=".$_[0]."&stype=all";
+	my $query = "https://www.freebsd.org/cgi/ports.cgi?query=".$_[0]."&stype=all";
 	my @lines = split /\n/, &fetchdoc($query);
 	my @names;
 	my @versions;
 	my @dates;
 	my @sizes;
@@ -402,11 +402,11 @@ sub freebsd {
 			my @parts = split /"/, $lines[$i];
 			($names[$now],$versions[$now]) = &combos_freebsd($parts[1]);
 			my @subparts = split /\//, $parts[3];
 			push @sizes, "";
 			push @repos, $subparts[@subparts-2];
-			push @urls,  "http://www.freebsd.org/cgi/ports.cgi?stype=all&query=$names[$now]";
+			push @urls,  "https://www.freebsd.org/cgi/ports.cgi?stype=all&query=$names[$now]";
 			$now++;
 			push @dates, "";
 		}
 	}
 	for (my $i = 0; $i < @repos; $i++) {
@@ -550,11 +550,11 @@ sub openbsd_combos {
 }
 
 sub openbsd_newer {
 	my $rel = $openbsd_release;
 	my $arch = "i386";
-	my $baseurl = 'http://ftp.openbsd.org/pub/OpenBSD/'.$rel.'/packages/'.$arch.'/';
+	my $baseurl = 'https://ftp.openbsd.org/pub/OpenBSD/'.$rel.'/packages/'.$arch.'/';
 	my @names;
 	my @versions;
 	my @urls;
 	my @repos;
 	my @sizes;
@@ -597,11 +597,11 @@ sub openbsd_newer {
 }
 
 sub openbsd_older {
 	my $rel = $openbsd_release;
 	my $arch = "i386";
-	my $baseurl = "http://www.openbsd.org/".$rel.'_packages/';
+	my $baseurl = "https://www.openbsd.org/".$rel.'_packages/';
 	my @names;
 	my @versions;
 	my @urls;
 	my @repos;
 	my @sizes;
@@ -644,11 +644,11 @@ sub openbsd_older {
 	}
 	return ();
 }
 
 sub cygwin {
-	my $baseurl = "http://www.cygwin.com/packages";
+	my $baseurl = "https://www.cygwin.com/packages";
 	my @names;
 	my @versions;
 	my @urls;
 	my @repos;
 	my @sizes;
@@ -691,12 +691,12 @@ sub cygwin {
 	}
 	return ();
 }
 
 sub gentoo {
-	my $gentoobase = "http://gpo.zugaina.org/";
-	my $gentoobaseofficial = "http://packages.gentoo.org/package";
+	my $gentoobase = "https://gpo.zugaina.org/";
+	my $gentoobaseofficial = "https://packages.gentoo.org/package";
 	my $distroname = "Gentoo";
 	my @names;
 	my @versions;
 	my @urls;
 	my @dates;
@@ -814,11 +814,11 @@ sub slack_combos {
 	my @parts = split /-/, $_[0];
 	return ((join '-', @parts[0..(@parts-4)]),$parts[(@parts-3)]);
 }
 
 sub slack {
-	my $slackbase  = "http://packages.slackware.com/";
+	my $slackbase  = "https://packages.slackware.com/";
 	my @repos;
 	my @groups;
 	my @names;
 	my @versions;
 	my @urls;
@@ -890,17 +890,17 @@ sub debian_size_convert {
 	}
 }
 
 sub debian {
 	my @dists = ($debian_current_release);
-	&debuntu('http://packages.debian.org','Debian',\@dists,$_[0]);
+	&debuntu('https://packages.debian.org','Debian',\@dists,$_[0]);
 	return();
 }
 
 sub ubuntu {
 	my @array = ($ubuntu_current_release);
-	&debuntu('http://packages.ubuntu.com','Ubuntu',\@array,$_[0]);
+	&debuntu('https://packages.ubuntu.com','Ubuntu',\@array,$_[0]);
 	return();
 }
 
 sub debuntu {
 	my ($baseurl,$distname,$releaseArrayP,$searchTerm) = @_;
@@ -1153,11 +1153,11 @@ sub trim($) {
 	$string =~ s/\s+$//;
 	return $string;
 }
 
 sub opensuse {
-	my $opensusebase = "http://software.opensuse.org";
+	my $opensusebase = "https://software.opensuse.org";
 	my @names;
 	my @repos;
 	my @groups;
 	my @versions;
 	my @urls;
@@ -1236,11 +1236,11 @@ sub sizeconvert {
 		die "Strange packet size encountered: $_[0]\n";
 	}
 }
 
 sub netbsd {
-	my @lines = split /\n|<br\/>/, &fetchdoc("http://pkgsrc.se/search.php?so=".$_[0]);
+	my @lines = split /\n|<br\/>/, &fetchdoc("https://pkgsrc.se/search.php?so=".$_[0]);
 	my @names;
 	my @versions;
 	my @dates;
 	my @sizes;
 	my @repos;

Vulnerable code: 	my $baseurl = "http://dl.fedoraproject.org/pub/fedora/linux/releases/";
	my $baseurl = "http://www.macports.org";
	my $baseurl = "http://pdb.finkproject.org/pdb/";
	my $query = "http://www.freebsd.org/cgi/ports.cgi?query=".$_[0]."&stype=all";
			push @urls,  "http://www.freebsd.org/cgi/ports.cgi?stype=all&query=$names[$now]";
	my $baseurl = 'http://ftp.openbsd.org/pub/OpenBSD/'.$rel.'/packages/'.$arch.'/';
	my $baseurl = "http://www.openbsd.org/".$rel.'_packages/';
	my $baseurl = "http://www.cygwin.com/packages";
	my $gentoobase = "http://gpo.zugaina.org/";
	my $gentoobaseofficial = "http://packages.gentoo.org/package";
	my $slackbase  = "http://packages.slackware.com/";
	&debuntu('http://packages.debian.org','Debian',\@dists,$_[0]);
	&debuntu('http://packages.ubuntu.com','Ubuntu',\@array,$_[0]);
	my $opensusebase = "http://software.opensuse.org";
	my @lines = split /\n|<br\/>/, &fetchdoc("http://pkgsrc.se/search.php?so=".$_[0]);
Fixed code: 	my $baseurl = "https://dl.fedoraproject.org/pub/fedora/linux/releases/";
	my $baseurl = "https://www.macports.org";
	my $baseurl = "https://pdb.finkproject.org/pdb/";
	my $query = "https://www.freebsd.org/cgi/ports.cgi?query=".$_[0]."&stype=all";
			push @urls,  "https://www.freebsd.org/cgi/ports.cgi?stype=all&query=$names[$now]";
	my $baseurl = 'https://ftp.openbsd.org/pub/OpenBSD/'.$rel.'/packages/'.$arch.'/';
	my $baseurl = "https://www.openbsd.org/".$rel.'_packages/';
	my $baseurl = "https://www.cygwin.com/packages";
	my $gentoobase = "https://gpo.zugaina.org/";
	my $gentoobaseofficial = "https://packages.gentoo.org/package";
	my $slackbase  = "https://packages.slackware.com/";
	&debuntu('https://packages.debian.org','Debian',\@dists,$_[0]);
	&debuntu('https://packages.ubuntu.com','Ubuntu',\@array,$_[0]);
	my $opensusebase = "https://software.opensuse.org";
	my @lines = split /\n|<br\/>/, &fetchdoc("https://pkgsrc.se/search.php?so=".$_[0]);