CVE-2021-4258 (published 2022-12-19T14:15Z)

A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package Information Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be initiated remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 667c3e2e9178f15c23d7918b5db25cd0792c8472. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216251. NOTE: Most sources redirect to the encrypted site which limits the possibilities of an attack.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-319
cwe_name: Cleartext Transmission of Sensitive Information
description: The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
extended_description: 
	 Many communication channels can be "sniffed" (monitored) by adversaries during data transmission. For example, in networking, packets can traverse many intermediary nodes from the source to the destination, whether across the internet, an internal network, the cloud, etc. Some actors might have privileged access to a network interface or any link along the channel, such as a router, but they might not be authorized to collect the underlying data. As a result, network traffic could be sniffed by adversaries, spilling security-critical data.
	 Applicable communication channels are not limited to software products. Applicable channels include hardware-specific technologies such as internal hardware networks and external debug channels, supporting remote JTAG debugging. When mitigations are not applied to combat adversaries within the product's threat model, this weakness significantly lowers the difficulty of exploitation by such adversaries.
	 When full communications are recorded or logged, such as with a packet dump, an adversary could attempt to obtain the dump long after the transmission has occurred and try to "sniff" the cleartext from the recorded communications in the dump itself. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.

         
         

Fix information:
repo_url: https://github.com/whohas/whohas
commit_details: repo_url: https://github.com/whohas/whohas
author: Paul Wise
author_date: 2021-11-02 09:20:03+08:00
msg: Use https when checking package information

Prevents network attackers from manipulating the displayed information.

Stick to http for Mandriva and SourceMage,
since they don't appear to support https.
repository: repo_url: https://github.com/whohas/whohas
repo_name: whohas/whohas
description: Cross-platform software search
repo_language: Perl
owner: whohas
file_changes: filename: whohas
change_type: ModificationType.MODIFY
diff: @@ -187,7 +187,7 @@ sub maxthreads {
 }
 
 sub fedora {
-	my $baseurl = "http://dl.fedoraproject.org/pub/fedora/linux/releases/";
+	my $baseurl = "https://dl.fedoraproject.org/pub/fedora/linux/releases/";
 	my $distroname = "Fedora";
 	my $arch = "x86_64";
 	my $searchy = $_[0];
@@ -261,7 +261,7 @@ sub month_to_digits {
 }
 
 sub macports {
-	my $baseurl = "http://www.macports.org";
+	my $baseurl = "https://www.macports.org";
 	my @names;
 	my @versions;
 	my @dates;
@@ -291,7 +291,7 @@ sub macports {
 
 
 sub fink {
-	my $baseurl = "http://pdb.finkproject.org/pdb/";
+	my $baseurl = "https://pdb.finkproject.org/pdb/";
 	my @names;
 	my @versions;
 	my @dates;
@@ -388,7 +388,7 @@ sub size_trim {
 
 
 sub freebsd {
-	my $query = "http://www.freebsd.org/cgi/ports.cgi?query=".$_[0]."&stype=all";
+	my $query = "https://www.freebsd.org/cgi/ports.cgi?query=".$_[0]."&stype=all";
 	my @lines = split /\n/, &fetchdoc($query);
 	my @names;
 	my @versions;
@@ -404,7 +404,7 @@ sub freebsd {
 			my @subparts = split /\//, $parts[3];
 			push @sizes, "";
 			push @repos, $subparts[@subparts-2];
-			push @urls,  "http://www.freebsd.org/cgi/ports.cgi?stype=all&query=$names[$now]";
+			push @urls,  "https://www.freebsd.org/cgi/ports.cgi?stype=all&query=$names[$now]";
 			$now++;
 			push @dates, "";
 		}
@@ -552,7 +552,7 @@ sub openbsd_combos {
 sub openbsd_newer {
 	my $rel = $openbsd_release;
 	my $arch = "i386";
-	my $baseurl = 'http://ftp.openbsd.org/pub/OpenBSD/'.$rel.'/packages/'.$arch.'/';
+	my $baseurl = 'https://ftp.openbsd.org/pub/OpenBSD/'.$rel.'/packages/'.$arch.'/';
 	my @names;
 	my @versions;
 	my @urls;
@@ -599,7 +599,7 @@ sub openbsd_newer {
 sub openbsd_older {
 	my $rel = $openbsd_release;
 	my $arch = "i386";
-	my $baseurl = "http://www.openbsd.org/".$rel.'_packages/';
+	my $baseurl = "https://www.openbsd.org/".$rel.'_packages/';
 	my @names;
 	my @versions;
 	my @urls;
@@ -646,7 +646,7 @@ sub openbsd_older {
 }
 
 sub cygwin {
-	my $baseurl = "http://www.cygwin.com/packages";
+	my $baseurl = "https://www.cygwin.com/packages";
 	my @names;
 	my @versions;
 	my @urls;
@@ -693,8 +693,8 @@ sub cygwin {
 }
 
 sub gentoo {
-	my $gentoobase = "http://gpo.zugaina.org/";
-	my $gentoobaseofficial = "http://packages.gentoo.org/package";
+	my $gentoobase = "https://gpo.zugaina.org/";
+	my $gentoobaseofficial = "https://packages.gentoo.org/package";
 	my $distroname = "Gentoo";
 	my @names;
 	my @versions;
@@ -816,7 +816,7 @@ sub slack_combos {
 }
 
 sub slack {
-	my $slackbase  = "http://packages.slackware.com/";
+	my $slackbase  = "https://packages.slackware.com/";
 	my @repos;
 	my @groups;
 	my @names;
@@ -892,13 +892,13 @@ sub debian_size_convert {
 
 sub debian {
 	my @dists = ($debian_current_release);
-	&debuntu('http://packages.debian.org','Debian',\@dists,$_[0]);
+	&debuntu('https://packages.debian.org','Debian',\@dists,$_[0]);
 	return();
 }
 
 sub ubuntu {
 	my @array = ($ubuntu_current_release);
-	&debuntu('http://packages.ubuntu.com','Ubuntu',\@array,$_[0]);
+	&debuntu('https://packages.ubuntu.com','Ubuntu',\@array,$_[0]);
 	return();
 }
 
@@ -1155,7 +1155,7 @@ sub trim($) {
 }
 
 sub opensuse {
-	my $opensusebase = "http://software.opensuse.org";
+	my $opensusebase = "https://software.opensuse.org";
 	my @names;
 	my @repos;
 	my @groups;
@@ -1238,7 +1238,7 @@ sub sizeconvert {
 }
 
 sub netbsd {
-	my @lines = split /\n|<br\/>/, &fetchdoc("http://pkgsrc.se/search.php?so=".$_[0]);
+	my @lines = split /\n|<br\/>/, &fetchdoc("https://pkgsrc.se/search.php?so=".$_[0]);
 	my @names;
 	my @versions;
 	my @dates;

programming_language: Perl