CVE-2021-22568 (published 2021-12-09T17:15Z)

When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0

Severity: MEDIUM
CVSS v2 base score: 6.0 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L)

Weakness information:
cwe_id: CWE-668
cwe_name: Exposure of Resource to Wrong Sphere
description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
extended_description: 
            Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
            A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
            In either case, the end result is that a resource has been exposed to the wrong party.
         
         

Fix information:
repo_url: https://github.com/dart-lang/sdk
commit_details: repo_url: https://github.com/dart-lang/sdk
author: Sigurd Meldgaard
author_date: 2021-09-14 16:05:00+00:00
msg: Bump pub

New commits in this revision:

git log --format=%C(auto) %h %s cafadd17ba285dad9ebe6d34c617bc0d70d096b3..98a01e1cdbf441f030f1be76417860b6b372663d ✓
 cafadd17 Don't use null safety (yet) (#3112)
 98a01e1c Store credentials in a config directory (#3092)
 4ee280b7 Fixed messages (#3110)
 bbdac802 Third party hosted pub registry authentication (#3007)
 b1bedc53 `--examples` for get/upgrade/downgrade/add/remove (#2857)

Change-Id: Ibf6ffe33820c97114958c1564a7c22a46ff73d9c
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/213348
Commit-Queue: Sigurd Meldgaard <sigurdm@google.com>
Reviewed-by: Jonas Jensen <jonasfj@google.com>
repository: repo_url: https://github.com/dart-lang/sdk
repo_name: dart-lang/sdk
description: The Dart SDK, including the VM, dart2js, core libraries, and more.
repo_language: Dart
owner: dart-lang
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -132,7 +132,18 @@ Updated the Linter to `1.11.0`, which includes changes that
 - fixes false positives in `use_rethrow_when_possible`.
 - improves performance for `annotate_overrides`, `prefer_contains`, and
   `prefer_void_to_null`.
+
 ### Pub
+
+- Adds support for token-based authorization to third party package-repositories
+  with the new command `dart pub token`.
+- Credentials are no longer stored in the pub-cache, but in a platform dependent
+  config directory:
+  * On Linux `$XDG_CONFIG_HOME/dart/pub-credentials.json` if `$XDG_CONFIG_HOME`
+    is defined, otherwise `$HOME/.config/dart/pub-credentials.json`
+  * On Mac OS: `$HOME/Library/Application Support/dart/pub-credentials.json`
+  * On Windows: `%APPDATA%/dart/pub-credentials.json`
+
 - Detect potential leaks in `dart pub publish`.
   When publishing, pub will examine your files for potential secret keys, and
   warn you.
@@ -140,7 +151,10 @@ Updated the Linter to `1.11.0`, which includes changes that
   To ignore a file that has a false positive, add it to a
   [`false_secrets`](https://dart.dev/go/false-secrets) section of your
   `pubspec.yaml`.
-- Fixes unicode terminal detection windows
+- Fixes unicode terminal detection windows.
+- New flag `--example` to the commands 
+  `dart pub get/upgrade/downgrade/add/remove` that will result in the `example/`
+  folder dependencies to be updated after operating in the current directory. 
 
 ## 2.14.1 - 2021-09-09
 

programming_language: Markdown
filename: DEPS
change_type: ModificationType.MODIFY
diff: @@ -138,7 +138,7 @@ vars = {
   "pool_rev": "7abe634002a1ba8a0928eded086062f1307ccfae",
   "process_rev": "56ece43b53b64c63ae51ec184b76bd5360c28d0b",
   "protobuf_rev": "c1eb6cb51af39ccbaa1a8e19349546586a5c8e31",
-  "pub_rev": "d95c5713dda518ed53ada70e00789e6aadbfbe48",
+  "pub_rev": "cafadd17ba285dad9ebe6d34c617bc0d70d096b3",
   "pub_semver_rev": "a43ad72fb6b7869607581b5fedcb186d1e74276a",
   "resource_rev": "6b79867d0becf5395e5819a75720963b8298e9a7",
   "root_certificates_rev": "692f6d6488af68e0121317a9c2c9eb393eb0ee50",

programming_language: Python