THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-37150

Private npm registry support used scope auth token for downloading tarballs

Reserved:2024-06-03
Published:2024-06-06
Updated:2024-06-06

Description

An issue in `.npmrc` support in Deno 1.44.0 was discovered where Deno would send `.npmrc` credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage. It is recommended to upgrade to Deno 1.44.1 and if your private registry ever serves tarballs at a different domain to rotate your registry credentials.



HIGH: 7.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

= 1.44.0
affected

References

https://github.com/denoland/deno/security/advisories/GHSA-rfc6-h225-3vxv

https://github.com/denoland/deno/commit/566adb7c0a0c0845e90a6e867a2c0ef5d2ada575

https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-scoped-registry%22

cve.org CVE-2024-37150

nvd.nist.gov CVE-2024-37150

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-37150