medium5.9
CVE-2019-15608
TOCTOU Race Condition in Yarn
Impact
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | yarn | < 1.19.0 | 1.19.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Yarnpkg | Yarn | before 1.19.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md#1190
- https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c
- https://hackerone.com/reports/703138
- https://github.com/advisories/GHSA-hjxc-462x-x77j
- https://nvd.nist.gov/vuln/detail/CVE-2019-15608