Description

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Remediation

References

https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md

https://hackerone.com/reports/640904

https://yarnpkg.com/blog/2019/07/12/recommended-security-update/

Related Vulnerabilities

CVE-2023-33695 Vulnerability in maven package cn.hutool:hutool-core

CVE-2023-50101 Vulnerability in maven package com.jfinal:jfinal

CVE-2021-23450 Vulnerability in npm package dojo

CVE-2022-29172 Vulnerability in npm package auth0-lock

CVE-2021-32854 Vulnerability in maven package org.webjars:textangular

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Permissions Required Vendor Advisory CWE-319