Fluid Attacks Database

Description

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://[[:]@][:][:][/]". The password value is not redacted and is printed to stdout and also to any generated log files.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	npm	>=0 <6.14.6+ds-1	6.14.6+ds-1
debian 11	npm	>=0 <6.14.6+ds-1	6.14.6+ds-1
npm	npm	>=0 <6.14.6	6.14.6
debian 14	npm	>=0 <6.14.6+ds-1	6.14.6+ds-1
debian 13	npm	>=0 <6.14.6+ds-1	6.14.6+ds-1
npm	cli	<0	-
rpm rhel8	nodejs	<1:10.23.1-1.module+el8.3.0+9502+012d8a97	1:10.23.1-1.module+el8.3.0+9502+012d8a97
rpm rhel8.1	nodejs	<1:12.18.4-2.module+el8.1.0+8360+14141500	1:12.18.4-2.module+el8.1.0+8360+14141500

Aliases

1. CVE-2020-150952. NVD-2020-150953. OSV-DEBIAN-2020-150954. OSV-2020-150955. GHSA-93f3-23rq-pjfp6. GCVE-2020-150957. SECURITY-TRACKER-CVE-2020-150958. security.gentoo.org

References

1. https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp2. https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc3. https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-074. https://lists.fedoraproject.org/archives/list/[email protected]/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O65. http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html6. http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html7. http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.