rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution.
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.02366·Published 2017-07-21·Fixed in 1.4.4CWE-300