Quick answers
- Is CVE-2019-15608 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-15608 being exploited in the wild.
- How severe is CVE-2019-15608?
- Low severity, with a CVSS score of 3.1, published 9 February 2022.
- Which products and versions are affected?
- yarn (npm) SEMVER:introduced=0,fixed=1.19.0.
- Is there a fix for CVE-2019-15608?
- Yes. yarn (npm): upgrade to 1.19.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-15608 attacked?
- It is attacked over the network or with local access, in a software library.
- Am I affected by CVE-2019-15608?
- Check whether you run yarn (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- yarn (npm): upgrade to 1.19.0 or later
npm install yarn@1.19.0
Technical details
The vulnerability is a TOCTOU (Time-of-Check-Time-of-Use) race condition in Yarn's package integrity validation, classified as CWE-367. The root cause is that package hash validation occurs before caching the package, but the cached version is not re-validated on subsequent reads. An attacker on the network or with local filesystem access can exploit this by modifying a package in transit or in the cache between the hash check and when it's actually used, leading to cache pollution. The attack requires network proximity or local filesystem access but no authentication. The vulnerability is fixed in Yarn 1.19.0, which validates stored package integrity before loading from cache.
Affected products
- Yarn Yarn < 1.19.0
Identifiers
- CVE-2019-15608
- GHSA-hjxc-462x-x77j
Timeline
- 2020-03-15: disclosed
- 2019: patched: Fixed in version 1.19.0
- 2022-02-09: advisory