VulnerabilityModified

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which…

MEDIUM 5.9EPSS 1.77%

Does this matter?

Lower severity and a low EPSS score (1.77%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 1.77% probability · 77th percentile
CISA KEV: Not listed
Weakness: CWE-347
Affected: yarnpkg/website
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-FiredThird Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfThird Party Advisory
https://github.com/yarnpkg/website/commits/masterThird Party Advisory
https://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-FiredThird Party Advisory
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfThird Party Advisory
https://github.com/yarnpkg/website/commits/masterThird Party Advisory
https://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.