GHSA-q8xg-8xwf-m598
Machine-In-The-Middle in lix
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
All versions of `lix` are vulnerable to Machine-In-The-Middle. The package accepts downloads with `http` and follows `location` header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a malicious source.
## Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
References
External links from the advisory. They lead to third-party sites.