Sparkle security vulnerability

[JamesMcMahon]

Older versions of Sparkle have a rather serious security vulnerability in it that allows a man in the middle attack to remote execute code during an update check.

All Sparkle versions older than 1.13.1 which fetch appcast or release notes over insecure HTTP connection are vulnerable to a man-in-the-middle attack that can lead to disclosure of local files or remote code execution.

Applications using Sparkle with HTTPS appcast feed URLs and HTTPS release notes links (if any) are safe.

More details at:

• Security vulnerability — please update Sparkle ASAP sparkle-project/Sparkle#720
• https://vulnsec.com/2016/osx-apps-vulnerabilities/
• http://arstechnica.com/security/2016/02/huge-number-of-mac-apps-vulnerable-to-hijacking-and-a-fix-is-elusive/

Only update URLs not using HTTPS are affected. I haven't tested the vulnerability with Amethyst but it looks like the app is using 1.9.0 so it would be affected by this issue (unless it's using HTTPS for updates).

[ianyh]

The Amethyst app cast is secured, but the update is valuable regardless so I'll leave this open.

[ianyh]

This actually got updated in #403