Sensitive Data Exposure in pem
Summary
GHSA-pgcr-7wm4-mcv6: Sensitive Data Exposure in pem. Affects pem versions < 1.13.2. Fixed in 1.13.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pem package is an npm package used for working with PEM files in Node.js. It provides functions to read and write PEM files, convert between different formats, and perform various cryptographic operations. The package is widely used in applications that require handling certificates, keys, and other cryptographic data. However, versions of pem before 1.13.2 are vulnerable to sensitive data exposure.
Vulnerability Detail
The vulnerability in pem versions before 1.13.2 is related to the readPkcs12 function. When this function is used to read a pkcs12 file, it creates a globally readable file in the temporary directory. This file contains the encryption password used to decrypt the certificate and key data. The file is not properly cleaned up after it is used, allowing any user with access to read files from the system to obtain the password. This can lead to unauthorized access to the pkcs12 password and the sensitive data it protects.
How To Fix
Minimum fixed version
1.13.2
This is the first release that contains the fix.
npm install pem@1.13.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to a fixed version of the pem package.
Conclusion
In conclusion, the pem package versions before 1.13.2 are vulnerable to sensitive data exposure. It is crucial to update to a fixed version of the package to prevent unauthorized access to sensitive data. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pem →
FAQ
This vulnerability can lead to unauthorized access to sensitive data, as the password used to decrypt the data is exposed.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
There are no known exploits for this vulnerability at the moment. However, it is important to update to a fixed version of the pem package to mitigate the risk.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-pgcr-7wm4-mcv6/GHSA-pgcr-7wm4-mcv6.json
