CVE-2017-18869: Low severity ibm cognos analytics vulnerability
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
Other sources
Affected versions of chownr are vulnerable to Time of Check Time of Use (TOCTOU). It does not dereference symbolic links and changes the owner of the link.
Upstream bug:
https://github.com/isaacs/chownr/issues/14
Upstream patch:
https://github.com/simevo/chownr/commit/0307bb7520c856f3e586815959141103ed7590c4
References:
https://snyk.io/vuln/npm:chownr:20180731 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985#10
— Red Hat
chownr package for Node.js could allow a local attacker to launch a symlink attack, caused by a TOCTOU issue. A local attacker could exploit this vulnerability using symlink attacks to trick the library into descending into unintended directories.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-18869?
CVE-2017-18869 is considered a moderate severity vulnerability due to its potential for local privilege escalation through symlink attacks.
How do I fix CVE-2017-18869?
To remediate CVE-2017-18869, upgrade the chownr package to version 1.1.0 or later.
Which software is affected by CVE-2017-18869?
CVE-2017-18869 affects the chownr package for Node.js versions prior to 1.1.0.
Can I use IBM Cognos Analytics with CVE-2017-18869?
Yes, IBM Cognos Analytics versions 12.0.0-12.0.3 and 11.2.0-11.2.4 FP4 are affected and should be patched.
What type of attack does CVE-2017-18869 enable?
CVE-2017-18869 enables a local attacker to perform a Time of Check Time of Use (TOCTOU) attack by descending into unintended directories.