GHSA-pgcr-7wm4-mcv6

Source

https://github.com/advisories/GHSA-pgcr-7wm4-mcv6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-pgcr-7wm4-mcv6/GHSA-pgcr-7wm4-mcv6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-pgcr-7wm4-mcv6

Published

2019-06-04T15:42:45Z

Modified

2021-08-04T21:28:00Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Sensitive Data Exposure in pem

Details

Versions of pem before 1.13.2 expose sensitive data when the readPkcs12 is used.

The readPkcs12 function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in the temporary directory containing the password which is then read by OpenSSL. The file containing the password is never cleaned up after it is used giving access to the pkcs12 password to any other users with access to read files from the system.

Recommendation

Update to version 1.13.2 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2019-06-04T15:41:30Z",
    "nvd_published_at":  null,
    "severity":  "CRITICAL"
}

References

Affected packages

npm / pem

Package

Name: pem; View open source insights on deps.dev
Purl: pkg:npm/pem

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.13.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-pgcr-7wm4-mcv6/GHSA-pgcr-7wm4-mcv6.json"