PT-2021-15145 · Dart Sdk · Dart Sdk

Published 2021-12-09 · Updated 2021-12-14 · CVE-2021-22568

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dart SDK versions prior to 2.15.0

Description The issue arises when using the dart pub publish command to publish a package to a third-party package server. The request is authenticated with an oauth2 access token that is valid for publishing on pub.dev. An attacker can use these obtained credentials to impersonate the user on pub.dev.

Recommendations For versions prior to 2.15.0, upgrade past the commit https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or to version 2.15.0 or beyond to resolve the issue. As a temporary workaround, consider restricting the use of the dart pub publish command to trusted package servers until the upgrade is applied.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-255

CWE-668

Related Identifiers

CVE-2021-22568

GHSA-R32F-VHJP-QHJ7

Affected Products

Dart Sdk

References · 8

• https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 · Patch
• https://github.com/dart-lang/sdk/blob/main/CHANGELOG.md · Patch
• https://osv.dev/vulnerability/CVE-2021-22568 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22568 · Security Note
• https://github.com/dart-lang/sdk/security/advisories/GHSA-r32f-vhjp-qhj7 · Note
• https://github.com/dart-lang/sdk · Note
• https://t.me/cibsecurity/33717 · Telegram Post
• https://t.me/cvenotify/24468 · Telegram Post