CVE-2021-1234

A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the vManage software must be in cluster mode. This vulnerability is due to the absence of authentication for sensitive information in the cluster management interface. An attacker could exploit this vulnerability by sending a crafted request to the cluster management interface of an affected system. A successful exploit could allow the attacker to view sensitive information on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the vManage software must be in cluster mode. This vulnerability is due to the absence of authentication for sensitive information in the cluster management interface. An attacker could exploit this vulnerability by sending a crafted request to the cluster management interface of an affected system. A successful exploit could allow the attacker to view sensitive information on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the vManage software must be in cluster mode. This vulnerability is due to the absence of authentication for sensitive information in the cluster management interface. An attacker could exploit this vulnerability by sending a crafted request to the cluster management interface of an affected system. A successful exploit could allow the attacker to view sensitive information on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

A vulnerability in the cluster management interface of Cisco SD-WAN vManage Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. To be affected by this vulnerability, the vManage software must be in cluster mode. This vulnerability is due to the absence of authentication for sensitive information in the cluster management interface. An attacker could exploit this vulnerability by sending a crafted request to the cluster management interface of an affected system. A successful exploit could allow the attacker to view sensitive information on the affected system.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

These are all security issues fixed in the pnpm-10.11.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pnpm fixes the following issues:

Changes in pnpm:

• update to 10.22.0:

  • Minor Changes

    • Added support for trustPolicyExclude #10164. You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:

      trustPolicy: no-downgrade trustPolicyExclude: - [email protected] - [email protected] || 5.102.1

    • Allow to override the engines field on publish by the publishConfig.engines field.

  • Patch Changes
    • Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10179.

• update to 10.21.0:

  • Minor Changes

    • Node.js Runtime Installation for Dependencies. Added support for automatic Node.js runtime installation for dependencies. pnpm will now install the Node.js version required by a dependency if that dependency declares a Node.js runtime in the "engines" field. For example:

      { "engines": { "runtime": { "name": "node", "version": "^24.11.0", "onFail": "download" } } }

      If the package with the Node.js runtime dependency is a CLI app, pnpm will bind the CLI app to the required Node.js version. This ensures that, regardless of the globally installed Node.js instance, the CLI will use the compatible version of Node.js. If the package has a postinstall script, that script will be executed using the specified Node.js version. Related PR: #10141

    • Added a new setting: trustPolicy. When set to no-downgrade, pnpm will fail installation if a package’s trust level has decreased compared to previous releases — for example, if it was previously published by a trusted publisher but now only has provenance or no trust evidence. This helps prevent installing potentially compromised versions of a package. Related issue: #8889.

    • Added support for pnpm config get globalconfig to retrieve the global config file path #9977.

  • Patch Changes
    • When a user runs pnpm update on a dependency that is not directly listed in package.json, none of the direct dependencies should be updated #10155.
    • Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #10160.
    • Setting gitBranchLockfile and related settings via pnpm-workspace.yaml should work #9651.

• update to 10.20.0:

  • Minor Changes
    • Support --all option in pnpm --help to list all commands #8628.
  • Patch Changes
    • When the latest version doesn't satisfy the maturity requirement configured by minimumReleaseAge, pick the highest version that is mature enough, even if it has a different major version #10100.
    • create command should not verify patch info.
    • Set managePackageManagerVersions to false, when switching to a different version of pnpm CLI, in order to avoid subsequent switches #10063.

• update to 10.19.0:

  • Minor Changes

    • You can now allow specific versions of dependencies to run postinstall scripts. onlyBuiltDependencies now accepts package names with lists of trusted versions. For example: Related PR: #10104.

      onlyBuiltDependencies: - [email protected] || 21.6.5 - [email protected]

    • Added support for exact versions in minimumReleaseAgeExclude #9985. You can now list one or more specific versions that pnpm should allow to install, even if those versions don’t satisfy the maturity requirement set by minimumReleaseAge. For example:

      minimumReleaseAge: 1440 minimumReleaseAgeExclude: - [email protected] - [email protected] ||…