CVE-2024-37150: Private npm registry support used scope auth token for downloading tarballs
An issue in .npmrc support in Deno 1.44.0 was discovered where Deno would send .npmrc credentials for the scope to the tarball URL when the registry provided URLs for a tarball on a different domain. All users relying on .npmrc are potentially affected by this vulnerability if their private registry references tarball URLs at a different domain. This includes usage of deno install subcommand, auto-install for npm: specifiers and LSP usage. It is recommended to upgrade to Deno 1.44.1 and if your private registry ever serves tarballs at a different domain to rotate your registry credentials.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37150?
The severity of CVE-2024-37150 is classified as high due to the potential exposure of sensitive credentials.
How do I fix CVE-2024-37150?
To fix CVE-2024-37150, upgrade Deno to the latest version beyond 1.44.0 to mitigate the vulnerability.
Who is affected by CVE-2024-37150?
All users of Deno version 1.44.0 who rely on the .npmrc configuration are potentially affected by CVE-2024-37150.
What are the consequences of CVE-2024-37150?
CVE-2024-37150 can lead to unauthorized access to sensitive credentials if exploited.
Is there a workaround for CVE-2024-37150 until a fix is applied?
As a temporary workaround for CVE-2024-37150, consider removing or adjusting the use of .npmrc credentials in your Deno configuration.