CVE-2021-22568: Exposure of Resource to Wrong Sphere (CWE-668)
value: When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 8.8
Published: 2021-12-09T17:15Z
Repository: https://github.com/dart-lang/sdk
Language: Other
Files changed: CHANGELOG.md, DEPS
Commit date: 2021-09-14 16:05:00 +0000
Commit message: Bump pub

New commits in this revision:

git log --format=%C(auto) %h %s cafadd17ba285dad9ebe6d34c617bc0d70d096b3..98a01e1cdbf441f030f1be76417860b6b372663d ✓
 cafadd17 Don't use null safety (yet) (#3112)
 98a01e1c Store credentials in a config directory (#3092)
 4ee280b7 Fixed messages (#3110)
 bbdac802 Third party hosted pub registry authentication (#3007)
 b1bedc53 `--examples` for get/upgrade/downgrade/add/remove (#2857)

Change-Id: Ibf6ffe33820c97114958c1564a7c22a46ff73d9c
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/213348
Commit-Queue: Sigurd Meldgaard <sigurdm@google.com>
Reviewed-by: Jonas Jensen <jonasfj@google.com>

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ddec26c2cc..0fed6d6189e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -130,19 +130,33 @@ Updated the Linter to `1.11.0`, which includes changes that
 - fixes false positives in `prefer_void_to_null`.
 - fixes false positives in `omit_local_variable_types`.
 - fixes false positives in `use_rethrow_when_possible`.
 - improves performance for `annotate_overrides`, `prefer_contains`, and
   `prefer_void_to_null`.
+
 ### Pub
+
+- Adds support for token-based authorization to third party package-repositories
+  with the new command `dart pub token`.
+- Credentials are no longer stored in the pub-cache, but in a platform dependent
+  config directory:
+  * On Linux `$XDG_CONFIG_HOME/dart/pub-credentials.json` if `$XDG_CONFIG_HOME`
+    is defined, otherwise `$HOME/.config/dart/pub-credentials.json`
+  * On Mac OS: `$HOME/Library/Application Support/dart/pub-credentials.json`
+  * On Windows: `%APPDATA%/dart/pub-credentials.json`
+
 - Detect potential leaks in `dart pub publish`.
   When publishing, pub will examine your files for potential secret keys, and
   warn you.
 
   To ignore a file that has a false positive, add it to a
   [`false_secrets`](https://dart.dev/go/false-secrets) section of your
   `pubspec.yaml`.
-- Fixes unicode terminal detection windows
+- Fixes unicode terminal detection windows.
+- New flag `--example` to the commands 
+  `dart pub get/upgrade/downgrade/add/remove` that will result in the `example/`
+  folder dependencies to be updated after operating in the current directory. 
 
 ## 2.14.1 - 2021-09-09
 
 - Fixed an issue specific to the macOS ARM64 (Apple Silicon) SDK, where the Dart
   commandline tools did not have the expected startup performance.
diff --git a/DEPS b/DEPS
index 427f6e8ba8f..522840a7b5c 100644
--- a/DEPS
+++ b/DEPS
@@ -136,11 +136,11 @@ vars = {
   "platform_rev": "c20e6fa315e9f8820e51c0ae721f63aff33b8e17",
   "ply_rev": "604b32590ffad5cbb82e4afef1d305512d06ae93",
   "pool_rev": "7abe634002a1ba8a0928eded086062f1307ccfae",
   "process_rev": "56ece43b53b64c63ae51ec184b76bd5360c28d0b",
   "protobuf_rev": "c1eb6cb51af39ccbaa1a8e19349546586a5c8e31",
-  "pub_rev": "d95c5713dda518ed53ada70e00789e6aadbfbe48",
+  "pub_rev": "cafadd17ba285dad9ebe6d34c617bc0d70d096b3",
   "pub_semver_rev": "a43ad72fb6b7869607581b5fedcb186d1e74276a",
   "resource_rev": "6b79867d0becf5395e5819a75720963b8298e9a7",
   "root_certificates_rev": "692f6d6488af68e0121317a9c2c9eb393eb0ee50",
   "rust_revision": "b7856f695d65a8ebc846754f97d15814bcb1c244",
   "shelf_static_rev": "202ec1a53c9a830c17cf3b718d089cf7eba568ad",

Vulnerable code: - Fixes unicode terminal detection windows
  "pub_rev": "d95c5713dda518ed53ada70e00789e6aadbfbe48",
Fixed code: 

- Adds support for token-based authorization to third party package-repositories
  with the new command `dart pub token`.
- Credentials are no longer stored in the pub-cache, but in a platform dependent
  config directory:
  * On Linux `$XDG_CONFIG_HOME/dart/pub-credentials.json` if `$XDG_CONFIG_HOME`
    is defined, otherwise `$HOME/.config/dart/pub-credentials.json`
  * On Mac OS: `$HOME/Library/Application Support/dart/pub-credentials.json`
  * On Windows: `%APPDATA%/dart/pub-credentials.json`

- Fixes unicode terminal detection windows.
- New flag `--example` to the commands 
  `dart pub get/upgrade/downgrade/add/remove` that will result in the `example/`
  folder dependencies to be updated after operating in the current directory. 
  "pub_rev": "cafadd17ba285dad9ebe6d34c617bc0d70d096b3",