CVE-2019-5448

8.1

HIGHCVSS v3

Published

July 30, 2019

CVSS v2

4.3 MEDIUM

Affected

5 projects

Assigned by

[email protected]

Severity scale

010

Description

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

yarn

NPM📦🐈 Fast, reliable, and secure dependency management.

< 1.17.3NVD

yarnpkg/yarn

GitHubThe 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry

< 1.17.3NVD

Yarn

NuGet Gallery

More on this CVE

NVD↗GitHub Advisory↗

Yet Another Repository for .Net

< 1.17.3NVD

yarn

RubyGemsA multi-process web-server written in Ruby 1.9.

< 1.17.3NVD

thejspr/yarn

GitHubMulti-process webserver written in Ruby. Part of my thesis project.

< 1.17.3NVD

Security Advisories

CVE-2019-5448

Description

More on this CVE