The pem package, a Node.js library designed for generating private keys and certificates, saw a minor version update from 1.4.3 to 1.4.4 in December 2014. Both versions, authored by Andris Reinman, share the same core functionality of simplifying the creation of cryptographic keys and certificates directly within Node.js applications, eliminating the need to rely on external command-line tools or complex OpenSSL configurations. Developers benefit from the library's ability to programmatically generate these essential security components, making it suitable for applications requiring secure communication, authentication, or data encryption.
The notable difference between versions 1.4.3 and 1.4.4 lies primarily in bug fixes and minor improvements. While the specific details of these changes aren't explicitly detailed in the provided metadata, the update likely addresses issues uncovered in the previous version, improving stability and reliability. Developers considering using pem should therefore opt for version 1.4.4 as it represents a more refined and potentially more secure iteration of the library. Both versions rely on the nodeunit package for development-time testing, ensuring the core functionalities are working as expected. When incorporating pem into your project, always prioritize the latest stable release for the most up-to-date features and security enhancements. The package repository is located on Github.
All the vulnerabilities related to the version 1.4.4 of the package
Sensitive Data Exposure in pem
Versions of pem
before 1.13.2 expose sensitive data when the readPkcs12
is used.
The readPkcs12
function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in the temporary directory containing the password which is then read by OpenSSL. The file containing the password is never cleaned up after it is used giving access to the pkcs12 password to any other users with access to read files from the system.
Update to version 1.13.2 or later.