Skip to content
Fencer Intel
high 8.1

CVE-2022-1650 json

Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsource

published 4y ago modified 4mo ago also GHSA-6h5x-7c5m-7cr7 , EUVD-2022-2797

cvss
8.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.

Patch / fix

  • npm eventsource 1.1.1, 2.0.2
  • eventsource eventsource/eventsource v1.1.1, v2.0.2
  • node-eventsource Debian 14, Debian 13, Debian 12 2.0.2+~1.1.8-1

debian advisories DEBIAN-CVE-2022-1650

  • node-eventsource Ubuntu 18.04 LTS 0.2.1-1+deb10u1build0.18.04.1
  • node-eventsource Ubuntu 20.04 LTS 0.2.1-1+deb10u1build0.20.04.1
  • node-eventsource Ubuntu 22.04 LTS 1.1.0+~1.1.8-1ubuntu0.1
  • node-eventsource Ubuntu Pro 16.04 LTS 0.1.6-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-1650

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • dotnet3.1 RHEL 8 3.1.422-1.el8_6
  • dotnet-sdk-3.1 RHEL 8 3.1.422-1.el8_6
  • dotnet-hostfxr-3.1 RHEL 8 3.1.28-1.el8_6
  • dotnet-runtime-3.1 RHEL 8 3.1.28-1.el8_6
  • dotnet-templates-3.1 RHEL 8 3.1.422-1.el8_6
  • aspnetcore-runtime-3.1 RHEL 8 3.1.28-1.el8_6
  • dotnet-apphost-pack-3.1 RHEL 8 3.1.28-1.el8_6
  • dotnet-targeting-pack-3.1 RHEL 8 3.1.28-1.el8_6

red hat advisories RHSA-2022:6057RHSA-2022:6037RHBA-2022:5749RHBA-2022:5747RHBA-2022:5721

  • dotnet3.1 Rocky Linux 8 3.1.422-1.el8_6

rocky linux advisories RLSA-2022:6057

Is CVE-2022-1650 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-1650 updated cvss 9.3

eventsource: Exposure of Sensitive Information

  • Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-ui-rhel8 Red Hat OpenShift Developer Tools and Services odo Red Hat OpenShift Service Mesh 2.1 servicemesh-grafana, servicemesh-prometheus
    affected: no fix available
  • Red Hat 3scale API Management Platform 2 3scale-system 3scale-system
    affected: no fix available “Fix deferred”
  • Red Hat A-MQ Online eventsource Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/search-ui-rhel8
    affected: no fix available
  • Red Hat Integration Data Virtualisation Operator eventsource Red Hat Integration Service Registry eventsource
    affected: no fix planned “Out of support scope”
  • Red Hat .NET Core on Red Hat Enterprise Linux ComputeNode (v. 7) rh-dotnet31-dotnet 3.1.422-1.el7_9, rh-dotnet60-dotnet 6.0.107-1.el7_9, rh-dotnet60-dotnet-host 6.0.7-1.el7_9, rh-dotnet31-dotnet-host 3.1.28-1.el7_9, rh-dotnet31-dotnet-sdk-3.1 3.1.422-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.107-1.el7_9, +18 more Red Hat .NET Core on Red Hat Enterprise Linux Server (v. 7) rh-dotnet31-dotnet 3.1.422-1.el7_9, rh-dotnet60-dotnet 6.0.107-1.el7_9, rh-dotnet60-dotnet-host 6.0.7-1.el7_9, rh-dotnet31-dotnet-host 3.1.28-1.el7_9, rh-dotnet31-dotnet-sdk-3.1 3.1.422-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.107-1.el7_9, +18 more Red Hat .NET Core on Red Hat Enterprise Linux Workstation (v. 7) rh-dotnet31-dotnet 3.1.422-1.el7_9, rh-dotnet60-dotnet 6.0.107-1.el7_9, rh-dotnet60-dotnet-host 6.0.7-1.el7_9, rh-dotnet31-dotnet-host 3.1.28-1.el7_9, rh-dotnet31-dotnet-sdk-3.1 3.1.422-1.el7_9, rh-dotnet60-dotnet-sdk-6.0 6.0.107-1.el7_9, +18 more
    fixed: vendor fix RHSA-2022:6037
  • Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8 1.36.10-2
    fixed: vendor fix RHSA-2022:5006
  • Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-dashboard-rhel9 6-75
    fixed: vendor fix RHSA-2023:3642
  • Red Hat CodeReady Linux Builder (v. 9) dotnet-sdk-6.0-source-built-artifacts 6.0.107-1.el9_0
    fixed: vendor fix RHBA-2022:5749
show 8 more
  • Red Hat Enterprise Linux AppStream (v. 8) dotnet 6.0.107-1.el8_6, dotnet-host 6.0.7-1.el8_6, dotnet3.1 3.1.422-1.el8_6, dotnet6.0 6.0.107-1.el8_6, dotnet-sdk-3.1 3.1.422-1.el8_6, dotnet-sdk-6.0 6.0.107-1.el8_6, +15 more
    fixed: vendor fix RHSA-2022:6057
  • Red Hat Enterprise Linux AppStream (v. 9) dotnet-host 6.0.7-1.el9_0, dotnet6.0 6.0.107-1.el9_0, dotnet-sdk-6.0 6.0.107-1.el9_0, dotnet-hostfxr-6.0 6.0.7-1.el9_0, dotnet-runtime-6.0 6.0.7-1.el9_0, aspnetcore-runtime-6.0 6.0.7-1.el9_0, +5 more
    fixed: vendor fix RHBA-2022:5749
  • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-3.1-source-built-artifacts 3.1.422-1.el8_6, dotnet-sdk-6.0-source-built-artifacts 6.0.107-1.el8_6
    fixed: vendor fix RHSA-2022:6057
  • Red Hat Fuse Online 7.10.2.P1
    fixed: vendor fix RHSA-2022:5030
  • Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-ui-rhel8 v1.7.4-12
    fixed: vendor fix RHSA-2022:6429
  • Red Hat RHODF 4.11 for RHEL 8 odf4/odf-console-rhel8 v4.11.0-51
    fixed: vendor fix RHSA-2022:6156
  • Red Hat RHPAM 7.13.1 async
    fixed: vendor fix RHSA-2022:6813
  • Red Hat OpenShift Service Mesh 2.1 openshift-service-mesh/pilot-rhel8 2.1.3-1, openshift-service-mesh/grafana-rhel8 2.1.3-1, openshift-service-mesh/proxyv2-rhel8 2.1.3-1, openshift-service-mesh/istio-cni-rhel8 2.1.3-1, openshift-service-mesh/ratelimit-rhel8 2.1.3-1, openshift-service-mesh/prometheus-rhel8 2.1.3-1, +3 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8, rhacm2/kui-web-terminal-rhel8 Red Hat build of Apicurio Registry 2 eventsource Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-rhel9 6-177, rhceph/keepalived-rhel9 2.2.4-3, rhceph/snmp-notifier-rhel9 1.2.1-36, rhceph/rhceph-haproxy-rhel9 2.4.17-4, rhceph/rhceph-promtail-rhel9 v2.4.0-5 Red Hat Data Grid 8 eventsource Red Hat Enterprise Linux 8 pcs, grafana, pcs-snmp, grafana-loki, grafana-mssql, grafana-mysql, +10 more
    +5 more products
    Red Hat Integration Camel K 1 eventsource Red Hat Migration Toolkit 1.7 rhmtc/openshift-velero-plugin-rhel8 v1.7.4-6, rhmtc/openshift-migration-velero-rhel8 v1.7.4-6, rhmtc/openshift-migration-openvpn-rhel8 v1.7.4-7, rhmtc/openshift-migration-registry-rhel8 v1.7.4-7, rhmtc/openshift-migration-rhel8-operator v1.7.4-15, rhmtc/openshift-migration-controller-rhel8 v1.7.4-7, +10 more Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-query-rhel8, rhosdt/jaeger-ingester-rhel8, rhosdt/jaeger-collector-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-es-rollover-rhel8, +1 more Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8 Red Hat RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8 v4.11.0-45, odf4/mcg-core-rhel8 v4.11.0-30, odf4/odf-topolvm-rhel8 v4.11.0-24, odf4/mcg-rhel8-operator v4.11.0-28, odf4/ocs-rhel8-operator v4.11.0-67, odf4/odf-rhel8-operator v4.11.0-27, +19 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.86% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • huntr.dev https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm eventsource
<1.1.1
>=2.0.0, <2.0.2
1.1.1
2.0.2

Affected products

  • eventsource eventsource/eventsource

Classification

Weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.