5.9

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Yarnpkg ≫ Website Version <= 2018-06-05
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.78% 0.753
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38
Third Party Advisory
Mailing List
https://github.com/RUB-NDS/Johnny-You-Are-Fired
Third Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
Third Party Advisory
https://github.com/yarnpkg/website/commits/master
Third Party Advisory
https://www.openwall.com/lists/oss-security/2019/04/30/4
Third Party Advisory
Mailing List