CVE-2019-16777: Arbitrary File Overwrite in npm CLI
First published: Fri Dec 13 2019(Updated: )
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Npmjs Npm | <6.13.4 | |
| openSUSE Leap | =15.1 | |
| Oracle GraalVM | =19.3.0.2 | |
| Fedoraproject Fedora | =31 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux Eus | =8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html
- https://access.redhat.com/errata/RHEA-2020:0330
- https://access.redhat.com/errata/RHSA-2020:0573
- https://access.redhat.com/errata/RHSA-2020:0579
- https://access.redhat.com/errata/RHSA-2020:0597
- https://access.redhat.com/errata/RHSA-2020:0602
- https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
- https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/
- https://security.gentoo.org/glsa/202003-48
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.npmjs.com/advisories/1437
- https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1788303
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1788302
- https://access.redhat.com/security/cve/CVE-2019-10773
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://access.redhat.com/security/cve/cve-2019-16777
- https://access.redhat.com/errata/RHSA-2020:2625
- https://bugzilla.redhat.com/show_bug.cgi?id=1788301
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/
Frequently Asked Questions
What is CVE-2019-16777?
CVE-2019-16777 is a vulnerability in versions of the npm CLI prior to 6.13.4 that allows for arbitrary file overwrite.
How severe is CVE-2019-16777?
CVE-2019-16777 is classified as high severity with a CVSS score of 6.5.
Which software versions are affected by CVE-2019-16777?
Versions prior to 6.13.4 of the npm CLI, 8.17.0, 10.18.0, 12.14.0, and 13.4.0 of Node.js, Npmjs Npm, openSUSE Leap, Oracle GraalVM, Fedora, and Redhat Enterprise Linux are affected.
How do I fix CVE-2019-16777?
To fix CVE-2019-16777, update to version 6.13.4 of the npm CLI or later.
Where can I find more information about CVE-2019-16777?
You can find more information about CVE-2019-16777 on the npm advisory page (https://www.npmjs.com/advisories/1437), the Node.js blog (https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/), and the npm blog (https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/author
- agent/weakness
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-16777
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/npmjs
- canonical/npmjs npm
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.1
- vendor/oracle
- canonical/oracle graalvm
- version/oracle graalvm/19.3.0.2
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/31
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- canonical/redhat enterprise linux eus
- version/redhat enterprise linux eus/8.1
- package-manager/redhat