[SECURITY] Fedora 36 Update: yarnpkg-1.22.19-5.fc36

Fast, reliable, and secure dependency management...

Fedora 36 : yarnpkg (2023-a4f0b29f6c)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a4f0b29f6c advisory. Apply fix for CVE-2022-37603. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Fedora 38 : yarnpkg (2023-2e38c3756f)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-2e38c3756f advisory. Apply fix for CVE-2022-37603. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Fedora: Security Advisory for yarnpkg (FEDORA-2023-2e38c3756f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for yarnpkg (FEDORA-2023-18fd476362)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for yarnpkg (FEDORA-2023-ce8943223c)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: yarnpkg-1.22.19-3.fc36

Fast, reliable, and secure dependency management...

[SECURITY] Fedora 37 Update: yarnpkg-1.22.19-3.fc37

Fast, reliable, and secure dependency management...

Fedora 36 : yarnpkg (2023-18fd476362)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-18fd476362 advisory. Add patches for CVE-2021-43138, CVE-2022-3517, CVE-2020-7677 Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 37 : yarnpkg (2023-ce8943223c)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ce8943223c advisory. Add patches for CVE-2021-43138, CVE-2022-3517, CVE-2020-7677 Tenable has extracted the preceding description block directly from the Fedora security...

[SECURITY] Fedora 36 Update: yarnpkg-1.22.19-2.fc36

Fast, reliable, and secure dependency management...

Fedora 36 : yarnpkg (2023-5c6f32db6f)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5c6f32db6f advisory. Update to 1.22.19. Backport patch for CVE-2021-35065 for bundled glob-parent. Tenable has extracted the preceding description block directly from th...

Fedora: Security Advisory for yarnpkg (FEDORA-2023-5c6f32db6f)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for yarnpkg (FEDORA-2023-8d4b772755)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 31 : nodejs-yarn (2020-766ce5adae)

Update to 1.21.1 - Provides /usr/bin/yarn - Resolves CVE-2019-10773 - Rename nodejs-yarn binary package to yarnpkg similar to other distros - Use nodejs macros consistently throughout spec - Make the tests fail the build if the tests fail Note that Tenable Network Security has extracted the...

Code injection

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...