CVE-2019-5448
30.07.2019, 21:15
Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.Enginsight
| Vendor | Product | Version |
|---|---|---|
| yarnpkg | yarn | 𝑥 < 1.17.3 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
- CWE-311 - Missing Encryption of Sensitive DataThe software does not encrypt sensitive or critical information before storage or transmission.
- CWE-319 - Cleartext Transmission of Sensitive InformationThe software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
References