PT-2019-20062 · Pem · Pem

Publicado 2019-06-04 · Atualizado 2019-06-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions pem versions prior to 1.13.2

Description The issue exposes sensitive data when the readPkcs12 function is used. This function reads certificate and key data from a pkcs12 file using the encryption password, creating a globally readable file with the password in the temporary directory. The file containing the password is not cleaned up after use, allowing access to the pkcs12 password to other users with read access to the system.

Recommendations Update to version 1.13.2 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

GHSA-PGCR-7WM4-MCV6

Produtos afetados

Pem

Referências · 5

• https://github.com/Dexus/pem/commit/bed1190e4a08692ac903ae6043489f1f76bc67eb · Nota
• https://github.com/Dexus/pem/pull/217 · Nota
• https://snyk.io/vuln/SNYK-JS-PEM-173687 · Nota
• https://osv.dev/vulnerability/GHSA-pgcr-7wm4-mcv6 · Aviso do Fabricante
• https://npmjs.com/advisories/723 · Nota