Description

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Remediation

References

https://github.com/ChALkeR/notes/blob/master/Yarn-vuln.md

https://yarnpkg.com/blog/2019/07/12/recommended-security-update/

https://hackerone.com/reports/640904

Related Vulnerabilities

CVE-2020-6426 Vulnerability in npm package electron

CVE-2021-31406 Vulnerability in maven package com.vaadin:flow-server

CVE-2020-7683 Vulnerability in npm package rollup-plugin-server

CVE-2020-28436 Vulnerability in npm package google-cloudstorage-commands

CVE-2020-8132 Vulnerability in npm package pdf-image

Severity

Critical

Classification

CWE-319 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Vendor Advisory Permissions Required