cve-2021-4435
Vulnerability from cvelistv5
Published
2024-02-04 19:16
Modified
2024-08-03 17:30
Severity ?
7.7 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Summary
Yarn: untrusted search path
References
patrick@puiterwijk.orghttps://access.redhat.com/security/cve/CVE-2021-4435Third Party Advisory
patrick@puiterwijk.orghttps://bugzilla.redhat.com/show_bug.cgi?id=2262284Issue Tracking
patrick@puiterwijk.orghttps://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1Patch
patrick@puiterwijk.orghttps://github.com/yarnpkg/yarn/releases/tag/v1.22.13Release Notes
Impacted products
n/ayarn
FedoraFedora
FedoraExtra Packages for Enterprise Linux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:30:07.387Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2021-4435"
          },
          {
            "name": "RHBZ#2262284",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262284"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/yarnpkg/yarn/releases/tag/v1.22.13"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "yarn",
          "vendor": "n/a",
          "versions": [
            {
              "status": "unaffected",
              "version": "1.22.13"
            }
          ]
        },
        {
          "collectionURL": "https://packages.fedoraproject.org/",
          "defaultStatus": "unaffected",
          "packageName": "yarnpkg",
          "product": "Fedora",
          "vendor": "Fedora"
        },
        {
          "collectionURL": "https://packages.fedoraproject.org/",
          "defaultStatus": "unaffected",
          "packageName": "yarnpkg",
          "product": "Extra Packages for Enterprise Linux",
          "vendor": "Fedora"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Paul Gerste (Sonar) for reporting this issue."
        }
      ],
      "datePublic": "2021-09-20T00:00:00+00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-04T19:16:35.651Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2021-4435"
        },
        {
          "name": "RHBZ#2262284",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262284"
        },
        {
          "url": "https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1"
        },
        {
          "url": "https://github.com/yarnpkg/yarn/releases/tag/v1.22.13"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-10-23T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2021-09-20T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Yarn: untrusted search path",
      "x_redhatCweChain": "CWE-426: Untrusted Search Path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2021-4435",
    "datePublished": "2024-02-04T19:16:35.651Z",
    "dateReserved": "2024-02-01T14:23:02.896Z",
    "dateUpdated": "2024-08-03T17:30:07.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2021-4435\",\"sourceIdentifier\":\"patrick@puiterwijk.org\",\"published\":\"2024-02-04T20:15:45.657\",\"lastModified\":\"2024-02-13T00:38:56.303\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 una vulnerabilidad de ruta de b\u00fasqueda no confiable en Yarn. Cuando una v\u00edctima ejecuta ciertos comandos de Yarn en un directorio con contenido controlado por un atacante, se podr\u00edan ejecutar comandos maliciosos de formas inesperadas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"patrick@puiterwijk.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.7,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-426\"}]},{\"source\":\"patrick@puiterwijk.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-426\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.22.13\",\"matchCriteriaId\":\"BCBACDE9-403C-4A92-8F39-ABCF4216F7AA\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2021-4435\",\"source\":\"patrick@puiterwijk.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2262284\",\"source\":\"patrick@puiterwijk.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1\",\"source\":\"patrick@puiterwijk.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/yarnpkg/yarn/releases/tag/v1.22.13\",\"source\":\"patrick@puiterwijk.org\",\"tags\":[\"Release Notes\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.