Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile
    causing unencrypted authentication data to be sent over the network. (CVE-2019-5448)

An update of the yarn package has been released.

ID	Name	Product	Family	Severity
422539	SCA: security update for yarn (GHSA-wqfc-cr59-h64p)	Tenable Cloud Security	SCA Checks	high
422539	SCA: security update for yarn (GHSA-wqfc-cr59-h64p)	Tenable Self-Hosted Container Security	SCA Checks	high
130123	Photon OS 3.0: Yarn PHSA-2019-3.0-0034	Nessus	PhotonOS Local Security Checks	high
129789	Photon OS 1.0: Yarn PHSA-2019-1.0-0252	Nessus	PhotonOS Local Security Checks	high
129687	Photon OS 1.0: Yarn PHSA-2019-1.0-0255	Nessus	PhotonOS Local Security Checks	high
129296	Photon OS 2.0: Yarn PHSA-2019-2.0-0176	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2019-5448

high

Tenable Plugins

high

high

high

high

high

high