crítica
CVE-2022-1650
eventsource: Exposure of Sensitive Information
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
GHSA9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Red Hat9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | eventsource | 1.1.1, 2.0.2 |
| debian 10 | node-eventsource | 0.2.1-1+deb10u1 |
| debian 11 | node-eventsource | 1.0.7-1+deb11u1 |
| debian 12 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 13 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 14 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 9 | node-eventsource | sin corrección indicada |
| echo | node-eventsource | 2.0.2+~1.1.8-1 |
| rapidfort Oracle Linux 9 | dotnet-host | 6.0.7-1.0.1.el9_0 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.107-1.el9_0 |
| rapidfort ubuntu 20.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
Mostrar las 29 entradas de 21 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| npm::GitHub Security Advisory npm | eventsource | 1.1.1, 2.0.2 |
| debian 10 | node-eventsource | 0.2.1-1+deb10u1 |
| debian 11 | node-eventsource | 1.0.7-1+deb11u1 |
| debian 12 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 13 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 14 | node-eventsource | 2.0.2+~1.1.8-1 |
| debian 9 | node-eventsource | sin corrección indicada |
| echo | node-eventsource | 2.0.2+~1.1.8-1 |
| rapidfort Oracle Linux 9 | dotnet-host | 6.0.7-1.0.1.el9_0 |
| rapidfort rocky 9 | dotnet6.0 | 0:6.0.107-1.el9_0 |
| rapidfort ubuntu 20.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
| rapidfort ubuntu 22.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
| rapidfort ubuntu 24.04 | node-eventsource | 0:1.1.0+~1.1.8-1ubuntu0.1 |
| Red Hat | servicemesh-grafana | sin corrección indicada |
| Red Hat | servicemesh-prometheus | sin corrección indicada |
| rocky 8 | aspnetcore-runtime-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | aspnetcore-targeting-pack-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-apphost-pack-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-hostfxr-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-runtime-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-sdk-3.1 | 3.1.422-1.el8_6 |
| rocky 8 | dotnet-targeting-pack-3.1 | 3.1.28-1.el8_6 |
| rocky 8 | dotnet-templates-3.1 | 3.1.422-1.el8_6 |
| ubuntu 16.04-ESM | node-eventsource | 0.1.6-1ubuntu0.1~esm1 |
| ubuntu 18.04 | node-eventsource | 0.2.1-1+deb10u1build0.18.04.1 |
| ubuntu 18.04-ESM | node-eventsource | 0.2.1-1+deb10u1build0.18.04.1 |
| ubuntu 20.04 | node-eventsource | 0.2.1-1+deb10u1build0.20.04.1 |
| ubuntu 20.04-ESM | node-eventsource | 0.2.1-1+deb10u1build0.20.04.1 |
| ubuntu 22.04 | node-eventsource | 1.1.0+~1.1.8-1ubuntu0.1 |
Referencias
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-1650.json
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-34716.json
- https://access.redhat.com/security/cve/CVE-2022-1650
- https://github.com/EventSource/eventsource/commit/f9f6416567bff62c1af2f4314be51d9870e94bc2
- https://github.com/EventSource/eventsource/pull/273#issuecomment-1127624508
- https://github.com/eventsource/eventsource
- https://github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4
- https://github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4%20%28v2.0.2%29
Las 14 referencias
- https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e
- https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e/
- https://lists.debian.org/debian-lts-announce/2022/12/msg00021.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-1650
- https://ubuntu.com/security/notices/USN-6082-1
- https://www.cve.org/CVERecord?id=CVE-2022-1650