An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.
References
Link | Resource |
---|---|
http://blog.npmjs.org/post/171169301000/v571 | Vendor Advisory |
https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0 | Third Party Advisory |
https://github.com/npm/npm/issues/19883 | Issue Tracking Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2018-02-22T18:00:00
Updated: 2018-02-23T01:57:01
Reserved: 2018-02-22T00:00:00
Link: CVE-2018-7408
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-02-22T18:29:00.253
Modified: 2019-10-03T00:03:26.223
Link: CVE-2018-7408
JSON object: View
Redhat Information
No data.
CWE