Описание
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Mobile Application Platform 4 | nodejs-chownr | Will not fix | ||
| Red Hat Software Collections | rh-nodejs6-nodejs-chownr | Will not fix | ||
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | rh-nodejs8-nodejs | Fixed | RHSA-2020:2625 | 19.06.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | rh-nodejs8-nodejs | Fixed | RHSA-2020:2625 | 19.06.2020 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | rh-nodejs8-nodejs | Fixed | RHSA-2020:2625 | 19.06.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.7 High
CVSS3
Связанные уязвимости
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 co ...
Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
Уязвимость пакета chownr программной платформы Node.js, позволяющая нарушителю получить несанкционированный доступ к произвольным каталогам
EPSS
7.7 High
CVSS3