CVE-2020-26149: Insufficiently Protected Credentials (CWE-522)
value: NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.
CWE description: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CVSS v3 base score: 7.5
Published: 2020-09-30T18:15Z
Repository: https://github.com/nats-io/nats.ws
Language: TypeScript
Files changed: .github/workflows/natsws.yml, package.json, src/nats-base-client.ts, src/ws_transport.ts
Commit date: 2020-09-29 14:44:35 -0500
Commit message: [update] [security] updated nats-base-client to v1.0.0-9 (#47)

* [update] [security] updated nats-base-client to v1.0.0-9

* bumped package version
Diff: diff --git a/.github/workflows/natsws.yml b/.github/workflows/natsws.yml
index e69b1e2..6d1ff5c 100644
--- a/.github/workflows/natsws.yml
+++ b/.github/workflows/natsws.yml
@@ -27,11 +27,11 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
       - name: Use Deno Version ${{ matrix.deno-version }}
         uses: denolib/setup-deno@master
         with:
-          deno-version: 1.4.0
+          deno-version: 1.4.2
       - name: Setup Go
         uses: actions/setup-go@v1
         with:
           go-version: ${{matrix.go}}
 #      - name: Set NATS Server Version
diff --git a/package.json b/package.json
index 3935e10..4d6eeef 100644
--- a/package.json
+++ b/package.json
@@ -1,8 +1,8 @@
 {
   "name": "nats.ws",
-  "version": "1.0.0-110",
+  "version": "1.0.0-111",
   "description": "WebSocket NATS client",
   "main": "nats.mjs",
   "types": "nats.d.ts",
   "files": [
     "examples/",
diff --git a/src/nats-base-client.ts b/src/nats-base-client.ts
index 7b8371e..224661d 100644
--- a/src/nats-base-client.ts
+++ b/src/nats-base-client.ts
@@ -10,6 +10,6 @@
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-export * from "https://raw.githubusercontent.com/nats-io/nats.deno/v1.0.0-8/nats-base-client/internal_mod.ts";
+export * from "https://raw.githubusercontent.com/nats-io/nats.deno/v1.0.0-9/nats-base-client/internal_mod.ts";
diff --git a/src/ws_transport.ts b/src/ws_transport.ts
index 7edf168..395a323 100644
--- a/src/ws_transport.ts
+++ b/src/ws_transport.ts
@@ -24,11 +24,11 @@ import {
   render,
   deferred,
   delay,
 } from "./nats-base-client.ts";
 
-const VERSION = "1.0.0-110";
+const VERSION = "1.0.0-111";
 const LANG = "nats.ws";
 
 export class WsTransport implements Transport {
   version: string = VERSION;
   lang: string = LANG;

Vulnerable code:           deno-version: 1.4.0
  "version": "1.0.0-110",
export * from "https://raw.githubusercontent.com/nats-io/nats.deno/v1.0.0-8/nats-base-client/internal_mod.ts";
const VERSION = "1.0.0-110";
Fixed code:           deno-version: 1.4.2
  "version": "1.0.0-111",
export * from "https://raw.githubusercontent.com/nats-io/nats.deno/v1.0.0-9/nats-base-client/internal_mod.ts";
const VERSION = "1.0.0-111";