Bug 1788328 (CVE-2019-10773)

Summary:	CVE-2019-10773 nodejs-yarn: Install functionality can be abused to generate arbitrary symlinks
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bdettelb, jschorr, nodejs-sig, tomckay, zsvetlik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	yarn 1.21.1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in Yarn in versions prior to 1.21.1. Arbitrary symlinks can be generated using the package install functionality leading to existing files being overwritten. The highest threat from this vulnerability is to system confidentiality and integrity as well as system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-02-11 20:09:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1788329
Bug Blocks:	1788330

Description Pedro Sampaio 2020-01-06 23:06:46 UTC

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

Upstream issue:

https://github.com/yarnpkg/yarn/issues/7761

Upstream patch:

https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7

References:

https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/
https://snyk.io/vuln/SNYK-JS-YARN-537806

Comment 1 Pedro Sampaio 2020-01-06 23:07:20 UTC

Created nodejs-yarn tracking bugs for this issue:

Affects: fedora-all [bug 1788329]

Comment 3 errata-xmlrpc 2020-02-11 18:32:13 UTC

This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2020:0475 https://access.redhat.com/errata/RHSA-2020:0475

Comment 4 Product Security DevOps Team 2020-02-11 20:09:33 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10773