~ / search / GHSA-wqfc-cr59-h64p

GHSA-wqfc-cr59-h64p

Missing Encryption of Sensitive Data in yarn

Source: GitHub Advisory Database (reviewed) High CVE-2019-5448

Packages

EcosystemPackageAffectedFixed in
npm yarn < 1.17.3 1.17.3

Details

As written in the advisory (Markdown source, shown as plain text).

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

References

External links from the advisory. They lead to third-party sites.