Описание
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious package was installed globally, later global remove, update, or add-replacement flows could re-derive those names from the installed manifest and pass path.join(globalBinDir, binName) to removeBin. For "." this targets the global bin directory; for ".." this targets its parent. This vulnerability is fixed in 10.34.2 and 11.5.3.
A flaw was found in pnpm, a package manager. When a malicious package with specially crafted manifest bin object keys (such as "." or "..") is installed globally, subsequent package management operations like removal, update, or replacement could lead to the deletion of critical directories. This could allow an attacker to cause a Denial of Service (DoS) by targeting the global bin directory or its parent.
Отчет
This Moderate severity flaw in pnpm, a package manager, could lead to a Denial of Service. When a malicious package with specially crafted manifest bin object keys is installed globally, subsequent package management operations can inadvertently delete critical system directories, including the global bin directory or its parent. This requires an attacker to first trick a user into installing a malicious package globally, limiting the immediate exploitability in typical Red Hat deployments.
Меры по смягчению последствий
To mitigate this issue, users should avoid installing pnpm packages from untrusted sources globally. Exercise caution and verify the integrity of packages before global installation to prevent the introduction of malicious manifest bin keys.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat AMQ Broker 7 | pnpm | Fix deferred | ||
| Red Hat Build of Keycloak | pnpm | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform 8 | pnpm | Fix deferred | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | pnpm | Fix deferred |
Показывать по
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious package was installed globally, later global remove, update, or add-replacement flows could re-derive those names from the installed manifest and pass path.join(globalBinDir, binName) to removeBin. For "." this targets the global bin directory; for ".." this targets its parent. This vulnerability is fixed in 10.34.2 and 11.5.3.
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin o ...
pnpm: Reserved bin name deletes PNPM_HOME during global remove
6.5 Medium
CVSS3