Github Token Leak in aegir

Description

Affected versions of aegir bundle and publish the current users github token to npm when aegir-release is executed.

Recommendation

Update the aegir package to the latest compatible version. Followings are version details:

• Affected version(s): >= 12.0.0, <= 12.0.7
• Patched version(s): 12.0.8

References

• GHSA-6xhf-x49c-m5m6
• www.npmjs.com
• CVE-2017-16225
• CWE-200
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Prototype pollution in 101 - CVE-2021-25943
• Use-After-Free in puppeteer - CVE-2019-5786
• Exposure of Sensitive Information to an Unauthorized Actor in AEgir - CVE-2020-11059
• Open Redirect in node-forge - CVE-2022-0122

Tags:

npm

aegir