CVE-2022-31051: semantic-release - Exposure of Sensitive Information to an Unauthorized Actor
Summary
CVE-2022-31051: Exposure of Sensitive Information to an Unauthorized Actor in semantic-release. Affects semantic-release versions >= 17.0.4, < 19.0.3. Fixed in 19.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
semantic-release is an npm package used for automating the release workflow of software projects. It provides a standardized way to manage versioning, changelogs, and publishing of releases. This vulnerability affects versions 17.0.4 to 19.0.2 of semantic-release. The vulnerability allows for the accidental disclosure of secrets that are normally masked by semantic-release. This can occur if the secrets contain characters that are excluded from URI encoding by the encodeURI function. However, the disclosure is limited to execution contexts where push access to the related repository is not available without modifying the repository URL to inject credentials.
Vulnerability Detail
The vulnerability in semantic-release arises from the improper masking of secrets that are included in URLs. When secrets contain characters that are excluded from encoding with encodeURI, they can be accidentally disclosed. This can lead to the exposure of sensitive information to unauthorized actors. The impact of this vulnerability is limited to situations where push access to the repository is not available without modifying the repository URL to inject credentials. The vulnerability has been assigned a CVSS score of 4.4, indicating a moderate severity level.
How To Fix
Minimum fixed version
19.0.3
This is the first release that contains the fix.
npm install semantic-release@19.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, users can ensure that their secrets do not contain characters that are excluded from encoding with encodeURI when included in a URL. By avoiding these characters, the secrets will be properly masked and the vulnerability will not be triggered.
Conclusion
The vulnerability in semantic-release allows for the accidental disclosure of secrets when they contain characters excluded from URI encoding. This can lead to the exposure of sensitive information to unauthorized actors. Users should upgrade to version 19.0.3 of semantic-release to fix this vulnerability. If immediate upgrading is not possible, users can follow the workaround mentioned above. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for semantic-release →
FAQ
semantic-release is an npm package used for automating the release workflow of software projects. It provides a standardized way to manage versioning, changelogs, and publishing of releases.
Versions 17.0.4 to 19.0.2 of semantic-release are affected by this vulnerability.
The vulnerability allows for the accidental disclosure of secrets that are normally masked by semantic-release. However, the disclosure is limited to execution contexts where push access to the related repository is not available without modifying the repository URL to inject credentials.
Yes, the vulnerability has been patched in version 19.0.3 of semantic-release.
If upgrading to the patched version is not immediately feasible, users can ensure that their secrets do not contain characters that are excluded from encoding with encodeURI when included in a URL.
References
Related vulnerabilities
Recent vulnerabilities recorded for semantic-release.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
