Not affected by unsafe HTTP configuration but affected by Sparkle bug which allows to exploit it in a case when XML file on the server was replaced since it's not signed using DSA key. You can still exploit it without HTTP and MITM "features".