GitHub Advisoryadvisory · npm

GHSA-qfcv-5whw-7pcw Exposure of Sensitive Information to an Unauthorized Actor in AEgir

CRITICAL Published 2020-05-27 Modified 2021-10-08 Official page ↗
Aliases
CVE-2020-11059
Ecosystem
npm
Packages
aegir
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-200
Reviewed
2020-05-27

Affected packages

• npm aegir: >= 21.7.0, < 21.10.1 → fixed in 21.10.1

Description

Impact `aegir publish` and `aegir build` may leak secrets from environmental variables in the browser bundle published to npm. Patches The code has been patched, users should upgrade to >= 21.10.1 Workarounds Run `printenv` to check your environment variables and revoke any secrets. For more information If you have any questions or comments about this advisory: • Open an issue in aegir

Related

Alias · CVE (1)

  • CVE-2020-11059 In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References