Candidate: CVE-2016-3956
PublicDate: 2016-07-02 14:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3956
 https://nodejs.org/en/blog/vulnerability/npm-tokens-leak-march-2016/
 https://github.com/npm/npm/issues/8380
 http://www-01.ibm.com/support/docview.wss?uid=swg21980827
 http://blog.npmjs.org/post/142036323955/fixing-a-bearer-token-vulnerability
Description:
 The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10
 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0,
 includes bearer tokens with arbitrary requests, which allows remote HTTP
 servers to obtain sensitive information by reading Authorization headers.
Ubuntu-Description:
 It was discovered that the npm command-line interface mishandled certain
 sensitive information. An attacker could use this vulnerability to collect
 authentication information that could be used to impersonate other users.
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [7.5 HIGH]
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [7.5 HIGH]

Patches_npm:
 upstream: https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401
 upstream: https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29
upstream_npm: needs-triage
precise_npm: ignored (reached end-of-life)
precise/esm_npm: DNE (precise was needs-triage)
trusty_npm: not-affected (code not present)
trusty/esm_npm: not-affected (code not present)
vivid/stable-phone-overlay_npm: DNE
vivid/ubuntu-core_npm: DNE
wily_npm: ignored (reached end-of-life)
xenial_npm: ignored (end of standard support, was needed)
yakkety_npm: ignored (reached end-of-life)
zesty_npm: ignored (reached end-of-life)
artful_npm: ignored (reached end-of-life)
bionic_npm: needed
cosmic_npm: not-affected (3.8.3)
disco_npm: not-affected (3.8.3)
eoan_npm: not-affected (3.8.3)
focal_npm: not-affected (3.8.3)
groovy_npm: not-affected (3.8.3)
hirsute_npm: not-affected (3.8.3)
impish_npm: not-affected (3.8.3)
jammy_npm: not-affected (3.8.3)
devel_npm: not-affected (3.8.3)