Description
The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.
References (6)
Core 6
Core References
Third Party Advisory x_refsource_misc
https://github.com/yarnpkg/website/commits/master
Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2019/Apr/38
Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://www.openwall.com/lists/oss-security/2019/04/30/4
Third Party Advisory x_refsource_misc
https://github.com/RUB-NDS/Johnny-You-Are-Fired
Third Party Advisory x_refsource_misc
https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdf
Scores
CVSS v3
5.9
EPSS
0.0177
EPSS Percentile
75.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-347
Status
published
Products (1)
yarnpkg/website
< 2018-06-05
Published
May 16, 2019
Tracked Since
Feb 18, 2026