Rapid7 Vulnerability & Exploit Database

SUSE: CVE-2019-16775: SUSE Linux Security Advisory

Back to Search

SUSE: CVE-2019-16775: SUSE Linux Security Advisory

Severity
4
CVSS
(AV:N/AC:L/Au:S/C:N/I:P/A:N)
Published
12/13/2019
Created
01/17/2020
Added
01/15/2020
Modified
04/08/2020

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Solution(s)

  • suse-upgrade-nodejs8
  • suse-upgrade-nodejs8-debuginfo
  • suse-upgrade-nodejs8-debugsource
  • suse-upgrade-nodejs8-devel
  • suse-upgrade-nodejs8-docs
  • suse-upgrade-npm8

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;