GHSA-hjxc-462x-x77j
TOCTOU Race Condition in Yarn
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-15608
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · yarn | introduced 0, fixed 1.19.0 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-15608 ADVISORY
- https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c WEB
- https://hackerone.com/reports/703138 WEB
- https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md#1190 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |