Github Token Leak in aegir

Description

Affected versions of aegir bundle and publish the current users github token to npm when aegir-release is executed.

Recommendation

Update the aegir package to the latest compatible version. Followings are version details:

• Affected version(s): >= 12.0.0, <= 12.0.7
• Patched version(s): 12.0.8

References

• GHSA-6xhf-x49c-m5m6
• www.npmjs.com
• CVE-2017-16225
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Strapi may leak sensitive user information, user reset password, tokens via content-manager views (GHSA-v8gg-4mq2-88q4) - CVE-2023-36472
• fetch(url) leads to a memory leak in undici - CVE-2024-24750
• Undici vulnerable to data leak when using response.arrayBuffer() - CVE-2024-38372
• Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to - CVE-2024-39691

Tags:

npm

aegir