Описание
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| node-yarnpkg | fixed | 1.22.19+~cs24.27.18-1 | package | |
| node-yarnpkg | no-dsa | bullseye | package | |
| node-yarnpkg | no-dsa | buster | package |
Примечания
https://bugzilla.redhat.com/show_bug.cgi?id=2262284
Fixed by: https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1 (v1.22.12)
Связанные уязвимости
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
ALT-PU-2021-5017: package `yarn` update to version 1.22.17-alt1