Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTV4ZjQtZjJmcS1mNjlq
Yarn Improper link resolution before file access (Link Following)
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Permalink: https://github.com/advisories/GHSA-5xf4-f2fq-f69jJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTV4ZjQtZjJmcS1mNjlq
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 4 years ago
Updated: 8 months ago
CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Identifiers: GHSA-5xf4-f2fq-f69j, CVE-2019-10773
References:
- https://nvd.nist.gov/vuln/detail/CVE-2019-10773
- https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023
- https://github.com/yarnpkg/yarn/pull/7755
- https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7
- https://access.redhat.com/errata/RHSA-2020:0475
- https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/
- https://snyk.io/vuln/SNYK-JS-YARN-537806,
- https://github.com/advisories/GHSA-5xf4-f2fq-f69j
Blast Radius: 37.9
Affected Packages
npm:yarn
Dependent packages: 3,296Dependent repositories: 71,861
Downloads: 23,215,161 last month
Affected Version Ranges: <= 1.21.1
Fixed in: 1.22.0
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.15.1, 0.16.0, 0.16.1, 0.17.0, 0.17.2, 0.17.3, 0.17.4, 0.17.5, 0.17.6, 0.17.7, 0.17.8, 0.17.9, 0.17.10, 0.18.0, 0.18.1, 0.18.2, 0.19.0, 0.19.1, 0.20.0, 0.20.3, 0.20.4, 0.21.0, 0.21.1, 0.21.2, 0.21.3, 0.22.0, 0.23.0, 0.23.1, 0.23.2, 0.23.3, 0.23.4, 0.24.0, 0.24.1, 0.24.2, 0.24.3, 0.24.4, 0.24.5, 0.24.6, 0.25.1, 0.25.2, 0.25.3, 0.25.4, 0.26.0, 0.26.1, 0.27.0, 0.27.1, 0.27.2, 0.27.3, 0.27.4, 0.27.5, 0.28.1, 0.28.4, 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0, 1.2.1, 1.3.1, 1.3.2, 1.4.0, 1.5.0, 1.5.1, 1.6.0, 1.7.0, 1.8.0, 1.9.1, 1.9.2, 1.9.4, 1.10.0, 1.10.1, 1.11.0, 1.11.1, 1.12.0, 1.12.1, 1.12.3, 1.13.0, 1.14.0, 1.15.0, 1.15.1, 1.15.2, 1.16.0, 1.17.0, 1.17.1, 1.17.2, 1.17.3, 1.18.0, 1.19.0, 1.19.1, 1.19.2, 1.21.0, 1.21.1
All unaffected versions: 1.22.0, 1.22.1, 1.22.4, 1.22.5, 1.22.6, 1.22.7, 1.22.8, 1.22.9, 1.22.10, 1.22.11, 1.22.12, 1.22.13, 1.22.14, 1.22.15, 1.22.16, 1.22.17, 1.22.18, 1.22.19, 1.22.20, 1.22.21, 1.22.22, 2.4.3