Piwik fails to perform signature validation when running updates.
b828fa052cbba603a1c31b4b2e170441da3919c6b79028adaa375fa4614c688aPiwik is an open-source web analytics tool. Its updater downloads and
executes PHP code over an insecure (not-HTTPS) connection. The issue was
reported on the public GitHub tracker in October of 2014 and remains
unfixed.
https://github.com/piwik/piwik/issues/6441
Code signing is implemented, but signatures are not verified.
Workaround: Manually download the update over HTTPS (the build server
has a valid SSL certificate), and check the signatures yourself.
-Taylor
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed