Skip to content

Sensitive Data Exposure in pem

Critical severity GitHub Reviewed Published Jun 4, 2019 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

npm pem (npm)

Affected versions

< 1.13.2

Patched versions

1.13.2

Description

Versions of pem before 1.13.2 expose sensitive data when the readPkcs12 is used.

The readPkcs12 function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in the temporary directory containing the password which is then read by OpenSSL. The file containing the password is never cleaned up after it is used giving access to the pkcs12 password to any other users with access to read files from the system.

Recommendation

Update to version 1.13.2 or later.

References

Reviewed Jun 4, 2019
Published to the GitHub Advisory Database Jun 4, 2019
Last updated Jan 9, 2023

Severity

Critical

Weaknesses

CVE ID

No known CVE

GHSA ID

GHSA-pgcr-7wm4-mcv6

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.