ALT-PU-2020-1415: package yarn update to version 1.22.0-alt1
Описание
This update upgrades yarn to version 1.22.0-alt1.
Устраненные уязвимости3
Ссылки4
GHSA-5xf4-f2fq-f69j
https://github.com/advisories/GHSA-5xf4-f2fq-f69jGHSA-8mfc-v7wv-p62g
https://github.com/advisories/GHSA-8mfc-v7wv-p62gGHSA-hjxc-462x-x77j
https://github.com/advisories/GHSA-hjxc-462x-x77jСвязанные уязвимости
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
In Yarn before 1.21.1, the package install functionality can be abused ...
Yarn Improper link resolution before file access (Link Following)