Fedora Account System
Red Hat Associate
Red Hat Customer
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files. References: https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07 https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp
Created nodejs tracking bugs for this issue: Affects: epel-all [bug 1856876] Affects: fedora-all [bug 1856877]
Flaw summary: NPM supports the ability to install packages from a hosted git provider[1] in the format: `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>[#<commit-ish> | #semver:<semver>]` As shown, a user could provide a password here. If the user does provide a password, it will be stored in the npm debug logs on the machine (default location $HOME/.npm/_logs/), which poses a security risk of an unauthorized person or group able to view the password in the logs. The patch avoids saving the password to the logs. NOTE: Using the above command format with a password provided in the terminal will still likely save the password to the terminal log e.g. bash history and is discouraged. Omitting the password from the URL command will create a prompt instead, and the password will be excluded from the terminal logs. 1. https://docs.npmjs.com/cli/install
Mitigation: Do not provide a password to npm via the cli to avoid it from being entered into the logs and stdout, or use ssh instead.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4272 https://access.redhat.com/errata/RHSA-2020:4272
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-15095
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2020:4903 https://access.redhat.com/errata/RHSA-2020:4903
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2020:5086 https://access.redhat.com/errata/RHSA-2020:5086
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:0521 https://access.redhat.com/errata/RHSA-2021:0521
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:0548 https://access.redhat.com/errata/RHSA-2021:0548