CVE-2018-12556: Medium severity yarn vulnerability
The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12556?
The severity of CVE-2018-12556 is medium with a CVSS score of 5.9.
How does CVE-2018-12556 affect Yarnpkg Website?
CVE-2018-12556 affects Yarnpkg Website versions up to and including 2018-06-05.
What is the CWE ID for CVE-2018-12556?
The CWE ID for CVE-2018-12556 is 347.
What is the reference for CVE-2018-12556?
You can find more information about CVE-2018-12556 at the following references: [1](http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html), [2](http://seclists.org/fulldisclosure/2019/Apr/38), [3](https://github.com/RUB-NDS/Johnny-You-Are-Fired).
How can I fix CVE-2018-12556 in Yarnpkg Website?
To fix CVE-2018-12556 in Yarnpkg Website, it is recommended to update to a version after 2018-06-05 that includes a fix for the signature verification routine.