CVE-2019-16775

Опубликовано: 13 дек. 2019

Источник: nvd

CVSS3: 7.7

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHEA-2020:0330
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0573
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0579
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0597
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0602
Third Party Advisory
https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
Third Party Advisory
https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/
https://www.oracle.com/security-alerts/cpujan2020.html
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html
Mailing List
Third Party Advisory
https://access.redhat.com/errata/RHEA-2020:0330
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0573
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0579
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0597
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0602
Third Party Advisory
https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
Third Party Advisory
https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:*

Версия до 6.13.3 (исключая)

Конфигурация 3

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:a:oracle:graalvm:19.3.0.2:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*

cpe:2.3:a:oracle:graalvm:21.2.2:*:*:*:enterprise:*:*:*

Конфигурация 5

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

EPSS

Процентиль: 53%

0.003

Низкий

7.7 High

CVSS3

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-61

CWE-59

Связанные уязвимости

CVE-2019-16775

CVSS3: 7.7

ubuntu

больше 5 лет назад

CVE-2019-16775

CVSS3: 4.8

redhat

больше 5 лет назад

CVE-2019-16775

CVSS3: 7.7

debian

больше 5 лет назад

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary ...

GHSA-m6cx-g6qm-p2cx

CVSS3: 7.7

github

больше 5 лет назад

Arbitrary File Write in npm

BDU:2019-04691

CVSS3: 7.7

fstec

больше 5 лет назад

Уязвимость набора инструментов командной строки пакетных менеджеров NPM и Yarn, позволяющая нарушителю записывать произвольные файлы

EPSS

Процентиль: 53%

0.003

Низкий

7.7 High

CVSS3

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-61

CWE-59