GHSA-7h42-5vj2-cq39

tiny-json-http missing SSL certificate validation

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000096

Packages

Ecosystem	Package	Affected	Fixed in
npm	tiny-json-http	>= 1.0.1, < 7.0.0	7.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

brianleroux tiny-json-http version all versions since commit [9b8e74a232bba4701844e07bcba794173b0238a8](https://github.com/brianleroux/tiny-json-http/commit/9b8e74a232bba4701844e07bcba794173b0238a8) (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the user to man-in-the-middle attacks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000096 advisory
https://github.com/brianleroux/tiny-json-http/pull/15 web
https://github.com/brianleroux/tiny-json-http/commit/3c1e36d8bef3ef5fd8e4447f816d5ffe2bfc3190 web
https://github.com/advisories/GHSA-7h42-5vj2-cq39 advisory
https://github.com/brianleroux/tiny-json-http package