CVE-2020-15095
Fixed in a distro release EPSS <1%CVSS 4.4
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.
Products: npm cli
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | npm | 6.14.6 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Chainguard | code-server | 0 |
| Chainguard | code-server-compat | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-19.2 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.3 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.4 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-19.5 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.1 | no fix |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.2 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.3 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.4 | 0 |
| Chainguard | commercial-gitlab-rails-ee-assets-fips-19.5 | no fix |
| Chainguard | gitlab-rails-ce-18.1 | 0 |
| Chainguard | gitlab-rails-ce-18.2 | 0 |
| Chainguard | gitlab-rails-ce-18.3 | 0 |
| Chainguard | gitlab-rails-ce-18.4 | 0 |
| Chainguard | gitlab-rails-ce-18.5 | 0 |
| Chainguard | gitlab-rails-ce-18.6 | 0 |
| Chainguard | gitlab-rails-ce-18.7 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.10 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.11 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.5 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.6 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.7 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.8 | 0 |
| Chainguard | gitlab-rails-ce-assets-18.9 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.0 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-19.5 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.10 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.11 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.5 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.6 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.7 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.8 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-18.9 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.0 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.1 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.2 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.3 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.4 | 0 |
| Chainguard | gitlab-rails-ce-assets-fips-19.5 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.1 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.2 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.3 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.4 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.5 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.6 | 0 |
| Chainguard | gitlab-rails-ce-doc-18.7 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.1 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.2 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.3 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.4 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.5 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.6 | 0 |
| Chainguard | gitlab-rails-ce-doc-fips-18.7 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.2 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.3 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.4 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.5 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.6 | 0 |
| Chainguard | gitlab-rails-ce-fips-18.7 | 0 |
| Chainguard | gitlab-rails-ee-17.0 | 0 |
| Chainguard | gitlab-rails-ee-17.1 | 0 |
| Chainguard | gitlab-rails-ee-17.10 | 0 |
| Chainguard | gitlab-rails-ee-17.2 | 0 |
| Chainguard | gitlab-rails-ee-assets-17.10 | 0 |
| Chainguard | gitlab-rails-ee-assets-fips-17.10 | 0 |
| Chainguard | gitlab-rails-ee-doc-17.10 | 0 |
| Chainguard | gitlab-rails-ee-doc-fips-17.10 | 0 |
| Chainguard | gitlab-rails-ee-fips-17.0 | 0 |
| Chainguard | gitlab-rails-ee-fips-17.1 | 0 |
| Chainguard | gitlab-rails-ee-fips-17.10 | 0 |
| Chainguard | gitlab-rails-ee-fips-17.2 | 0 |
| Debian 12 | npm | 6.14.6+ds-1 |
| Debian 13 | npm | 6.14.6+ds-1 |
| Debian 14 | npm | 6.14.6+ds-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat Enterprise Linux 8 | nodejs | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:10.23.1-1.module+el8.3.0+9502+012d8a97 |
| Red Hat Enterprise Linux 8 | nodejs-full-i18n | 1:12.18.4-2.module+el8.2.0+8361+192e434e |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8+2632+6c5111ed |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8+2873+aa7dfd9a |
| Red Hat Enterprise Linux 8 | npm | 1:6.14.10-1.10.23.1.1.module+el8.3.0+9502+012d8a97 |
| Red Hat Enterprise Linux 8 | npm | 1:6.14.6-1.12.18.4.2.module+el8.2.0+8361+192e434e |
| Red Hat rhel eus 8.1 | nodejs | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-debuginfo | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-debugsource | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-devel | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-docs | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-full-i18n | 1:12.18.4-2.module+el8.1.0+8360+14141500 |
| Red Hat rhel eus 8.1 | nodejs-nodemon | 0:1.18.3-1.module+el8.1.0+3369+37ae6a45 |
| Red Hat rhel eus 8.1 | nodejs-packaging | 0:17-3.module+el8.1.0+3369+37ae6a45 |
| Red Hat rhel eus 8.1 | npm | 1:6.14.6-1.12.18.4.2.module+el8.1.0+8360+14141500 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs | 0:10.23.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-debuginfo | 0:10.23.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-devel | 0:10.23.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-docs | 0:10.23.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-npm | 0:6.14.10-10.23.1.2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs | 0:12.18.4-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-debuginfo | 0:12.18.4-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-devel | 0:12.18.4-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-nodejs-docs | 0:12.18.4-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs12-npm | 0:6.14.6-12.18.4.3.el7 |
| Rocky Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | nodejs10 | 10.22.1-1.27.1 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | nodejs10 | 10.22.1-1.27.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs10 | 10.22.1-1.30.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs12 | 12.18.4-1.20.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs10 | 10.22.1-1.27.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs8 | 8.17.0-3.38.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP2 | nodejs10 | 10.22.1-1.27.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP2 | nodejs12 | 12.18.4-4.6.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP2 | nodejs8 | 8.17.0-10.3.1 |
| SUSE Linux Enterprise Server 15-LTSS | nodejs10 | 10.22.1-1.27.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 | nodejs10 | 10.22.1-1.27.1 |
| Ubuntu 14.04 LTS | npm | no fix |
| Ubuntu 20.04 LTS | npm | no fix |
| Ubuntu Pro 16.04 LTS | npm | no fix |
| Ubuntu Pro 18.04 LTS | npm | no fix |
| Wolfi | code-server | 0 |
| Wolfi | code-server-compat | 0 |
| openSUSE Leap 15.1 | nodejs8 | 8.17.0-lp151.2.21.1 |
| openSUSE Leap 15.2 | nodejs10 | 10.22.1-lp152.2.6.1 |
| openSUSE Leap 15.2 | nodejs12 | 12.18.4-lp152.3.6.1 |
| openSUSE Tumbleweed | nodejs14 | 14.17.5-1.2 |