CVE-2019-15608 TOCTOU Race Condition in Yarn
Attackers can exploit a time-of-check time-of-use flaw in Yarn's cache validation to inject malicious packages, leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-15608?
CVE-2019-15608 is a medium-severity vulnerability in yarn, published on 15 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
Which versions are affected by CVE-2019-15608?
2 open source packages ship an affected version, including yarn. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yarn npm | All versions | 1.19.0 |
yarn npm | All versions | 1.19.0 |
Products include Yarnpkg Yarn.
How do I fix CVE-2019-15608?
Upgrade yarn to 1.19.0 or later.
Is CVE-2019-15608 being exploited?
There is no known exploitation of CVE-2019-15608 in the wild and no public exploit code.
Other vulnerabilities in yarn
Sources
Also known as DEBIAN-CVE-2019-15608, GHSA-hjxc-462x-x77j.