Description
geoip-lite-country is a stripped down version of geoip-lite, supporting only country lookup. geoip-lite-country before 1.1.4 downloads data resources over HTTP, which leaves it vulnerable to MITM attacks.
Remediation
References
https://nodesecurity.io/advisories/183
Related Vulnerabilities
CVE-2020-14195 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2023-40812 Vulnerability in maven package org.opencrx:opencrx-core-models
CVE-2022-21144 Vulnerability in npm package libxmljs
CVE-2017-16144 Vulnerability in npm package myserver.alexcthomas18
CVE-2021-41973 Vulnerability in maven package org.apache.mina:mina-http