UBUNTU-CVE-2018-12556

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2018-12556

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-12556.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2018-12556

Upstream

CVE-2018-12556

Published

2019-05-16T17:29:00Z

Modified

2026-05-20T16:03:23.044756857Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.

References

Affected packages

Ubuntu:20.04:LTS / node-yarnpkg

Package

Name: node-yarnpkg
Purl: pkg:deb/ubuntu/node-yarnpkg?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.13.0-1build1

1.13.0-3

1.19.1-1

1.22.4-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "yarnpkg",
            "binary_version": "1.22.4-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-12556.json"

Ubuntu:22.04:LTS / node-yarnpkg

Package

Name: node-yarnpkg
Purl: pkg:deb/ubuntu/node-yarnpkg?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.22.10+~cs22.25.14-3

1.22.10+~cs22.25.14-4

1.22.10+~cs22.25.14-5

1.22.10+~cs22.25.14-8

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "yarnpkg",
            "binary_version": "1.22.10+~cs22.25.14-8"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-12556.json"

Ubuntu:24.04:LTS / node-yarnpkg

Package

Name: node-yarnpkg
Purl: pkg:deb/ubuntu/node-yarnpkg?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.22.19+~cs24.27.18-2

1.22.19+~cs24.27.18-4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "yarnpkg",
            "binary_version": "1.22.19+~cs24.27.18-4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-12556.json"

Ubuntu:25.10 / node-yarnpkg

Package

Name: node-yarnpkg
Purl: pkg:deb/ubuntu/node-yarnpkg?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.0.2+dfsg-3

4.1.0+dfsg-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "yarnpkg",
            "binary_version": "4.1.0+dfsg-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-12556.json"

Ubuntu:26.04:LTS / node-yarnpkg

Package

Name: node-yarnpkg
Purl: pkg:deb/ubuntu/node-yarnpkg?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.1.0+dfsg-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "yarnpkg",
            "binary_version": "4.1.0+dfsg-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-12556.json"