CVE-2019-15608: Medium severity yarn vulnerability
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-15608?
CVE-2019-15608 is a vulnerability in the package integrity validation in yarn < 1.19.0 that allows a cache pollution attack.
How severe is CVE-2019-15608?
CVE-2019-15608 has a severity score of 5.9 (medium).
Which software is affected by CVE-2019-15608?
Yarn versions prior to 1.19.0 are affected by CVE-2019-15608.
How can I fix CVE-2019-15608?
To fix CVE-2019-15608, update your Yarn version to at least 1.19.0.
Where can I find more information about CVE-2019-15608?
You can find more information about CVE-2019-15608 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-15608), [GitHub Commit](https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c), [HackerOne Report](https://hackerone.com/reports/703138).