{"id":"CVE-2016-10933","aliases":["EUVD-2021-1827","GHSA-pq6v-x7gp-7776","RUSTSEC-2016-0003"],"status":"published","title":"Source code is downloaded over cleartext HTTP in portaudio","description":"An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01078,"percentile":0.65267,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-254","CWE-319"],"published":"2016-08-01T12:00:00Z","modified":"2026-06-17T00:40:39Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"portaudio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.7.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"portaudio","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.7.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"portaudio","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"}]}]}],"products":[{"vendor":"portaudio_project","product":"portaudio"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2016-0003.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10933","tags":["advisory"]},{"url":"https://github.com/RustAudio/rust-portaudio/issues/144","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-pq6v-x7gp-7776"},{"url":"https://github.com/RustAudio/rust-portaudio","tags":["package"]},{"url":"https://crates.io/crates/portaudio","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2016-10933","description":"An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.","status":"published","published":"2019-08-26T12:03:36Z","modified":"2024-08-06T03:38:56.678Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2021-1827","description":"An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.","status":"published","published":"2019-08-26T12:03:36Z","modified":"2024-08-06T03:38:56Z","updated_at":"2026-11-03T02:22:22.621497Z"}],"ghsa":[{"id":"GHSA-pq6v-x7gp-7776","title":"Source code is downloaded over cleartext HTTP in portaudio","description":"An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.","status":"published","published":"2021-08-25T20:43:09Z","modified":"2023-02-01T05:05:57Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2016-10933","description":"An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.","status":"published","published":"2019-08-26T13:15:10.913Z","modified":"2026-06-17T00:40:39.01Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"GHSA-pq6v-x7gp-7776","title":"Source code is downloaded over cleartext HTTP in portaudio","description":"An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.","status":"published","published":"2021-08-25T20:43:09Z","modified":"2023-11-08T03:58:21.697594Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-319"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"RUSTSEC-2016-0003","title":"HTTP download and execution allows MitM RCE","description":"The build script in the portaudio crate will attempt to download via HTTP\nthe portaudio source and build it.\n\nA Mallory in the middle can intercept the download with their own archive\nand get RCE.","status":"published","published":"2016-08-01T12:00:00Z","modified":"2023-11-08T03:58:21.697594Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}