Lucene search

K

SnykCVELIST:CVE-2019-10773

HistoryDec 16, 2019 - 7:31 p.m.

CVE-2019-10773

2019-12-1619:31:34

snyk

www.cve.org

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.5%

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted “bin” keys. Existing files could be overwritten depending on the current user permission set.

CNA Affected

[
  {
    "product": "Yarn",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions prior to version 1.21.1"
      }
    ]
  }
]

References

access.redhat.com/errata/RHSA-2020:0475

blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/

github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7

github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/

snyk.io/vuln/SNYK-JS-YARN-537806%2C

7.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.5%

Related for CVELIST:CVE-2019-10773

nessus5 debiancve1 osv2 fedora2 github1 redhat1 openvas2 ubuntucve1 cve1 redhatcve1 veracode1 prion1 nvd1 photon6