GitHub Advisoryadvisory · npm

GHSA-hjxc-462x-x77j TOCTOU Race Condition in Yarn

MEDIUM Published 2022-02-09 Modified 2023-09-08 Official page ↗
Aliases
CVE-2019-15608
Ecosystem
npm
Packages
yarn
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-367
Reviewed
2021-04-08

Affected packages

• npm yarn: < 1.19.0 → fixed in 1.19.0

Description

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.

Related

Alias · CVE (1)

  • CVE-2019-15608 The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to… vulnerability

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References