GitHub Advisoryadvisory · npm

GHSA-wqfc-cr59-h64p Missing Encryption of Sensitive Data in yarn

HIGH Published 2019-07-31 Modified 2021-08-17 Official page ↗
Aliases
CVE-2019-5448
Ecosystem
npm
Packages
yarn
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-311, CWE-319
Reviewed
2019-07-31

Affected packages

• npm yarn: < 1.17.3 → fixed in 1.17.3

Description

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Related

Alias · CVE (1)

  • CVE-2019-5448 Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication… vulnerability

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References