CVE-2019-10773

{"containers": {"cna": {"affected": [{"product": "Yarn", "vendor": "n/a", "versions": [{"status": "affected", "version": "All versions prior to version 1.21.1"}]}], "descriptions": [{"lang": "en", "value": "In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set."}], "problemTypes": [{"descriptions": [{"description": "Arbitrary File Write", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-11T20:06:06.000Z", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-JS-YARN-537806%2C"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023"}, {"tags": ["x_refsource_MISC"], "url": "https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/"}, {"name": "FEDORA-2020-766ce5adae", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/"}, {"name": "FEDORA-2020-7525beefa1", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/"}, {"name": "RHSA-2020:0475", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2020:0475"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "ID": "CVE-2019-10773", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Yarn", "version": {"version_data": [{"version_value": "All versions prior to version 1.21.1"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Arbitrary File Write"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-JS-YARN-537806,", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-YARN-537806,"}, {"name": "https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7", "refsource": "MISC", "url": "https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7"}, {"name": "https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023", "refsource": "CONFIRM", "url": "https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023"}, {"name": "https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/", "refsource": "MISC", "url": "https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/"}, {"name": "FEDORA-2020-766ce5adae", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/"}, {"name": "FEDORA-2020-7525beefa1", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/"}, {"name": "RHSA-2020:0475", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2020:0475"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:32:01.551Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-JS-YARN-537806%2C"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/"}, {"name": "FEDORA-2020-766ce5adae", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/"}, {"name": "FEDORA-2020-7525beefa1", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/"}, {"name": "RHSA-2020:0475", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2020:0475"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2019-10773", "datePublished": "2019-12-16T19:31:34.000Z", "dateReserved": "2019-04-03T00:00:00.000Z", "dateUpdated": "2024-08-04T22:32:01.551Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Yarn", "vendor": "n/a", "versions": [{"status": "affected", "version": "All versions prior to version 1.21.1"}]}], "source": "report@snyk.io"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*", "matchCriteriaId": "6AD33651-1103-4375-8BCF-983DBCDF6470", "versionEndExcluding": "1.21.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set."}, {"lang": "es", "value": "En Yarn versiones anteriores a 1.21.1, la funcionalidad package install puede ser abusada para generar enlaces simb\u00f3licos arbitrarios en el sistema de archivos host mediante el uso de teclas \"bin\" especialmente dise\u00f1adas. Los archivos existentes podr\u00edan ser sobrescritos dependiendo del conjunto de permisos del usuario actual."}], "id": "CVE-2019-10773", "lastModified": "2026-06-17T02:11:38.710", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-16T20:15:14.477", "references": [{"source": "report@snyk.io", "url": "https://access.redhat.com/errata/RHSA-2020:0475"}, {"source": "report@snyk.io", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7"}, {"source": "report@snyk.io", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023"}, {"source": "report@snyk.io", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/"}, {"source": "report@snyk.io", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/"}, {"source": "report@snyk.io", "url": "https://snyk.io/vuln/SNYK-JS-YARN-537806%2C"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2020:0475"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://snyk.io/vuln/SNYK-JS-YARN-537806%2C"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2020:0475", "cpe": "cpe:/a:redhat:quay:3::el7", "package": "quay3/clair-jwt:v3.2.1-1", "product_name": "Red Hat Quay 3", "release_date": "2020-02-11T00:00:00Z"}], "bugzilla": {"description": "nodejs-yarn: Install functionality can be abused to generate arbitrary symlinks", "id": "1788328", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1788328"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-20", "details": ["In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted \"bin\" keys. Existing files could be overwritten depending on the current user permission set.", "A flaw was found in Yarn in versions prior to 1.21.1. Arbitrary symlinks can be generated using the package install functionality leading to existing files being overwritten. The highest threat from this vulnerability is to system confidentiality and integrity as well as system availability."], "name": "CVE-2019-10773", "public_date": "2019-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-10773\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-10773"], "threat_severity": "Important"}

{}