PT-2020-12520 · Npm · Aegir

Hugomrdias · Published 2020-05-27 · Updated 2021-10-07 · CVE-2020-11059

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AEgir versions 21.7.0 through 21.10.0

Description The issue concerns the leakage of secrets from environment variables in the browser bundle published to npm when using aegir publish and aegir build. This has been fixed in version 21.10.1.

Recommendations For AEgir versions 21.7.0 through 21.10.0, upgrade to version 21.10.1 or later to resolve the issue. As a temporary workaround, consider running printenv to check environment variables and revoke any secrets. Restrict access to sensitive environment variables to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-11059

GHSA-QFCV-5WHW-7PCW

Affected Products

Aegir

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-11059 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11059 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qfcv-5whw-7pcw · Vendor Advisory
• https://github.com/ipfs/aegir/security/advisories/GHSA-qfcv-5whw-7pcw · Note
• https://github.com/ipfs/aegir/commit/e36e1def57b2dc1e4b7a5beba964c5924e87f8d8 · Note
• https://github.com/ipfs/aegir · Note
• https://t.me/cibsecurity/12349 · Telegram Post
• https://t.me/cvenotify/4051 · Telegram Post