Cryptographic issues in yarn - CVE-2019-5448
Published: July 30, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30976
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2019-5448
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Yarn
Affected software:
yarn
yarn
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
How to mitigate CVE-2019-5448
Install update from vendor's website.