CVE-2017-18869

Reference Links

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985
• https://bugzilla.redhat.com/show_bug.cgi?id=1611614
• https://github.com/isaacs/chownr/issues/14
• https://snyk.io/vuln/npm:chownr:20180731
• https://github.com/simevo/chownr/commit/0307bb7520c856f3e586815959141103ed7590c4
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=863985#10
• https://access.redhat.com/errata/RHSA-2020:2625
• https://access.redhat.com/security/cve/cve-2017-18869
• https://bugzilla.redhat.com/show_bug.cgi?id=1611613
• https://www.ibm.com/support/pages/node/7177223 (Advisory)

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7177223

Frequently Asked Questions

• What is the severity of CVE-2017-18869?

  CVE-2017-18869 is considered a moderate severity vulnerability due to its potential for local privilege escalation through symlink attacks.

• How do I fix CVE-2017-18869?

  To remediate CVE-2017-18869, upgrade the chownr package to version 1.1.0 or later.

• Which software is affected by CVE-2017-18869?

  CVE-2017-18869 affects the chownr package for Node.js versions prior to 1.1.0.

• Can I use IBM Cognos Analytics with CVE-2017-18869?

  Yes, IBM Cognos Analytics versions 12.0.0-12.0.3 and 11.2.0-11.2.4 FP4 are affected and should be patched.

• What type of attack does CVE-2017-18869 enable?

  CVE-2017-18869 enables a local attacker to perform a Time of Check Time of Use (TOCTOU) attack by descending into unintended directories.