CVE-2018-12556 - The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key

Back Back to CVE browser

MEDIUM

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key

Published May 16, 2019

5.9

MEDIUM

CVSS 3.0

EPSS 1.77%

Description

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-347

References (7)

http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
x_refsource_MISCThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38
mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4516
Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired
x_refsource_MISCThird Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
x_refsource_MISCThird Party Advisory
https://github.com/yarnpkg/website/commits/master
x_refsource_MISCThird Party Advisory
https://www.openwall.com/lists/oss-security/2019/04/30/4
mailing-listx_refsource_MLISTMailing ListThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html		x_refsource_MISCThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38		mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-4516		Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired		x_refsource_MISCThird Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf		x_refsource_MISCThird Party Advisory
https://github.com/yarnpkg/website/commits/master		x_refsource_MISCThird Party Advisory
https://www.openwall.com/lists/oss-security/2019/04/30/4		mailing-listx_refsource_MLISTMailing ListThird Party Advisory