Important Photon OS Security Update - PHSA-2019-0252

Updates of 'linux', 'tar', 'bash', 'yarn', 'linux-esx', 'python2', 'openssl', 'kubernetes' packages of Photon OS have been released...

Node.js third-party modules: [yarn] yarn.lock integrity & hash check logic is broken

I would like to report a vulnerability in yarn. It allows to pollute yarn cache via a crafted yarn.lock file and place a malicious package into cache under any name/version, bypassing both integrity and hash checks in yarn.lock so that any future installs of that package will install the fake...

Photon OS 2.0: Yarn PHSA-2019-2.0-0176

An update of the yarn package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0176. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid129296;...

Missing Encryption of Sensitive Data in yarn

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

GHSA-WQFC-CR59-H64P Missing Encryption of Sensitive Data in yarn

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

@6river/rosbag (>=1.0.2-6river, <=1.1.0-browserOrNode.2), @jamesbliss/react-flickity (>=1.0.0, <=1.4.0) +26 more potentially affected by CVE-2019-5448 via yarn (>=1.0.2, <=1.16.0)

yarn NPM version =1.0.2, =1.0.2-6river, =1.0.0, =1.9.9-1, =1.0.0, =1.0.21, =8.3.8, =0.1.0, =3.0.0, =0.0.0-semantic-release, =1.9.7, =5.0.0-ts.4, =0.0.4, =0.0.14 and more Source cves: CVE-2019-5448 Source advisory: GHSA-WQFC-CR59-H64P...

@6river/rosbag (>=1.0.2-6river, <=1.1.0-browserOrNode.2), @jamesbliss/react-flickity (>=1.0.0, <=1.4.0) +26 more potentially affected by CVE-2019-5448 via yarn (>=1.0.2, <=1.16.0)

yarn NPM version =1.0.2, =1.0.2-6river, =1.0.0, =1.9.9-1, =1.0.0, =1.0.21, =8.3.8, =0.1.0, =3.0.0, =0.0.0-semantic-release, =1.9.7, =5.0.0-ts.4, =0.0.4, =0.0.14 and more Source cves: CVE-2019-5448 Source advisory: OSV:GHSA-WQFC-CR59-H64P...

Information Disclosure

yarn is vulnerable to information disclosure. The attack is possible because it does not use a secure connection for regular registries, allowing a man-in-the-middle to disclose and manipulate the sensitive information...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

DEBIAN-CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

Authentication flaw

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

UBUNTU-CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

CVE-2019-5448 affects Yarn; the vulnerability arises from HTTP URLs in a Yarn lockfile that can cause unencrypted authentication data to be transmitted. The connected advisories confirm Photon OS and Nessus plugins flag Yarn as affected and advise updating the Yarn package to mitigate. The exact ...

@6river/rosbag (>=1.0.2-6river, <=1.1.0-browserOrNode.2), @atto-byte/ui (1.0.4) +135 more potentially affected by CVE-2019-5448 via yarn (>=0.15.1, <=1.16.0)

yarn NPM version =0.15.1, =1.0.2-6river, =1.0.0, =1.0.0, =1.9.9-1, =1.0.0, =1.0.21, =1.6.6-0, =8.3.8, =0.1.0, =0.3.0 and more Source cves: CVE-2019-5448 Source advisory: MEND:CVE-2019-5448...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

PT-2019-17677

Name of the Vulnerable Software and Affected Versions Yarn versions prior to 1.17.3 Description The issue is related to missing encryption of sensitive data. Specifically, HTTP URLs in the lockfile cause unencrypted authentication data to be sent over the network. Recommendations For versions pri...