Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

yarn: Missing Encryption of Sensitive Data #1928

Closed
1 task done
KexyBiscuit opened this issue Jul 31, 2019 · 2 comments
Closed
1 task done

yarn: Missing Encryption of Sensitive Data #1928

KexyBiscuit opened this issue Jul 31, 2019 · 2 comments
Assignees
@eatradish
Labels
security Topic/issue involves a security issue/fixed

Comments

@KexyBiscuit
Copy link
Member

KexyBiscuit commented Jul 31, 2019 •
edited by eatradish

CVE IDs: CVE-2019-5448

Other security advisory IDs: N/A

Descriptions: Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Patches: Forces using https for the regular registries

PoC(s): N/A

Architectural progress:

  • Architecture-independent noarch (v1.16.0/stable)
@KexyBiscuit KexyBiscuit added security Topic/issue involves a security issue/fixed to-stable labels Jul 31, 2019
@KexyBiscuit KexyBiscuit added this to the Summer 2019 milestone Jul 31, 2019
eatradish added a commit that referenced this issue Aug 1, 2019
@eatradish
yarn: add patch for fix CVE-2019-5448 (#1928)
be972ac
@eatradish
Copy link
Member

All Done. Closing....

MingcongBai pushed a commit that referenced this issue Aug 7, 2019
@eatradish @MingcongBai
yarn: add patch for fix CVE-2019-5448 (#1928)
b8f8c2e
@liushuyu
Copy link
Member

Use AOSA-2019-0216.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@eatradish eatradish

Labels
security Topic/issue involves a security issue/fixed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@liushuyu @KexyBiscuit @eatradish