GHSA-pgcr-7wm4-mcv6 Sensitive Data Exposure in pem
Local attackers can read sensitive PKCS12 passwords from temporary files created by the pem library, exposing cryptographic keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-pgcr-7wm4-mcv6?
GHSA-pgcr-7wm4-mcv6 is a vulnerability in pem, published on 4 Jun 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Versions of pem before 1.13.2 expose sensitive data when the readPkcs12 is used.
The readPkcs12 function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in the temporary directory containing the password which is then read by OpenSSL. The file containing the password is never cleaned up after it is used giving access to the pkcs12 password to any other users with access to read files from the system.
Recommendation
Update to version 1.13.2 or later.
Which versions are affected by GHSA-pgcr-7wm4-mcv6?
2 open source packages ship an affected version, including pem.
| Package | Affected | Fixed in |
|---|---|---|
pem npm | All versions | 1.13.2 |
pem npm | All versions | 1.13.2 |
How do I fix GHSA-pgcr-7wm4-mcv6?
Upgrade pem to 1.13.2 or later.
Is GHSA-pgcr-7wm4-mcv6 being exploited?
There is no known exploitation of GHSA-pgcr-7wm4-mcv6 in the wild and no public exploit code.