ipfs/aegir · Security
Exposure of Sensitive Information to an Unauthorized Actor in AEgir
- GHSA ID
- GHSA-qfcv-5whw-7pcw
- CVE ID
- CVE-2020-11059
- Severity
- critical
- Published
- Updated
- CVSS
- 9.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- CVSS v3
- 9.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Description
Impact
aegir publish and aegir build may leak secrets from environmental variables in the browser bundle published to npm.
Patches
The code has been patched, users should upgrade to >= 21.10.1
Workarounds
Run printenv to check your environment variables and revoke any secrets.
For more information
If you have any questions or comments about this advisory:
- Open an issue in aegir
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor