Summary

Mirrored third-party repository URLs and notification channel URLs could redirect to unencrypted http URLs without TLS.

Who was affected

Organizations on Private Packagist Cloud until the fix on June 12, 2024, for mirrored third-party repositories and notification channels. On Private Packagist Self-Hosted installations running a version before 2.0.3 (KOTS) or 1.12.5 (Replicated Native), for notification channels only: Self-Hosted does not apply this restriction to mirrored third-party repository URLs, by design.

Impact

When a mirrored third-party repository URL or a notification channel URL redirected to an unencrypted http URL, Private Packagist sent the request to the new URL without TLS. On Self-Hosted this applied to notification channel URLs only. An attacker able to intercept the network traffic between Private Packagist and the server behind the http URL could have read or modified the data exchanged: for a mirrored third-party repository, the package information Private Packagist downloaded, which an attacker could have changed to offer different package versions or code than the repository provides; for a notification channel, the notifications Private Packagist sent, such as details of package updates and security issues.

What we did

On Private Packagist Cloud, URLs that redirect to insecure http URLs can no longer be used for mirrored third-party repositories and notification channels. On Self-Hosted, notification channel URLs that redirect to insecure http URLs can no longer be used.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.3 (KOTS) or 1.12.5 (Replicated Native) or any later version to protect notification channels. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required.

Credits

Thanks to Dominik Prodinger and Maciej Piechota (haqpl) for reporting this issue.

All security advisories