Description

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Remediation

References

https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md

https://hackerone.com/reports/640904

https://yarnpkg.com/blog/2019/07/12/recommended-security-update/

Related Vulnerabilities

CVE-2020-7693 Vulnerability in npm package sockjs

CVE-2021-23899 Vulnerability in maven package com.mikesamuel:json-sanitizer

CVE-2023-37908 Vulnerability in maven package org.xwiki.rendering:xwiki-rendering-xml

CVE-2020-8136 Vulnerability in npm package fastify-multipart

CVE-2021-23797 Vulnerability in npm package http-server-node

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Permissions Required Vendor Advisory CWE-319