Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJyajMtcW1oOC03MnBm

grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file

Versions of grunt-gh-pages prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.

In the grunt-gh-pages deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, grunt-gh-pages will write the token to a log file, unencrypted.

Recommendation

Update to version 0.10.0 or later.

Permalink: https://github.com/advisories/GHSA-rrj3-qmh8-72pf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJyajMtcW1oOC03MnBm
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 5 years ago
Updated: over 1 year ago

Identifiers: GHSA-rrj3-qmh8-72pf, CVE-2016-10526
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-10526
• https://github.com/tschaub/grunt-gh-pages/pull/41
• https://www.npmjs.com/advisories/85
• https://github.com/tschaub/grunt-gh-pages/pull/41/commits/590f69767203d8c379fe18cded93bd5ad6cb53cb
• https://github.com/tschaub/grunt-gh-pages/commit/2d277e3e969ccd4c2d493f3795400fa77e6b6342
• https://github.com/advisories/GHSA-rrj3-qmh8-72pf

Repository: https://github.com/tschaub/grunt-gh-pages
Blast Radius: 0.0

Affected Packages