CVE-2019-16776

Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the npm install are affected.

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Recommendation

Upgrade to version 6.13.3 or later.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

• nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

• nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

• nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

• npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

• npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

• npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

The following packages have been upgraded to a later upstream version: nodejs (12.14.1). (BZ#1791067)

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.19.0).

Security Fix(es):

• nodejs: HTTP request smuggling using malformed Transfer-Encoding header (CVE-2019-15605)

• nodejs: Remotely trigger an assertion on a TLS server with a malformed certificate string (CVE-2019-15604)

• nodejs: HTTP header values do not have trailing optional whitespace trimmed (CVE-2019-15606)

• npm: Symlink reference outside of node_modules folder through the bin field upon installation (CVE-2019-16775)

• npm: Arbitrary file write via constructed entry in the package.json bin field (CVE-2019-16776)

• npm: Global node_modules Binary Overwrite (CVE-2019-16777)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details.

This update for nodejs8 to version 8.17.0 fixes the following issues:

Security issues fixed:

• CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352).

This update was imported from the SUSE:SLE-15:Update update project.

This update for nodejs8 to version 8.17.0 fixes the following issues:

Security issues fixed:

• CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352).

This update for nodejs10 to version 10.18.0 fixes the following issues:

Security issues fixed:

• CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352).
• Added support for chacha20-poly1305 for Authenticated encryption (AEAD).

Non-security issues fixed:

• Fix wrong path in gypi files (bsc#1159812)

This update for nodejs10 to version 10.18.0 fixes the following issues:

Security issues fixed:

• CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352).
• Added support for chacha20-poly1305 for Authenticated encryption (AEAD).

Non-security issues fixed:

• Fixed wrong path in gypi files (bsc#1159812).

This update for nodejs6 to version 6.17.1 fixes the following issues:

Security issues fixed:

• CVE-2019-16777, CVE-2019-16776, CVE-2019-16775: Updated npm to 6.13.4, fixing an arbitrary path overwrite and access via 'bin' field (bsc#1159352).

This update for nodejs12 fixes the following issues:

nodejs12 was updated to version 12.15.0.

Security issues fixed:

• CVE-2019-15604: Fixed a remotely triggerable assertion in the TLS server via a crafted certificate string (CVE-2019-15604, bsc#1163104).
• CVE-2019-15605: Fixed an HTTP request smuggling vulnerability via malformed Transfer-Encoding header (CVE-2019-15605, bsc#1163102).
• CVE-2019-15606: Fixed the white space sanitation of HTTP headers (CVE-2019-15606, bsc#1163103).
• CVE-2019-16775: Fixed an arbitrary file write vulnerability (bsc#1159352).
• CVE-2019-16776: Fixed an arbitrary file write vulnerability (bsc#1159352).
• CVE-2019-16777: Fixed an arbitrary file write vulnerability (bsc#1159352).