Description

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Remediation

References

https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md

https://hackerone.com/reports/640904

https://yarnpkg.com/blog/2019/07/12/recommended-security-update/

Related Vulnerabilities

CVE-2020-26256 Vulnerability in npm package @fast-csv/parse

CVE-2023-22467 Vulnerability in npm package luxon

CVE-2022-36313 Vulnerability in npm package file-type

CVE-2018-16330 Vulnerability in maven package org.webjars.npm:editor.md

CVE-2022-31367 Vulnerability in npm package strapi-plugin-content-manager

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Permissions Required Vendor Advisory CWE-319