Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Fedora 42 - yarnpkg 2025-e73ea121f5 critical: fix path traversal

fedora
Calendar Grey April 11, 2025
Dist Fedora Esm H88
Fedora 42 update addresses critical CVE-2024-12905 impacting yarnpkg dependency management software.
Fix CVE-2024-12905.

Summary

Fast, reliable, and secure dependency management.

Update Information:

Fix CVE-2024-12905.

Topics%20covered

Topics Covered

security advisory Fedora CVE fix package management path traversal yarnpkg

Change Log

* Fri Mar 28 2025 Sandro Mani - 1.22.22-7 - Fix CVE-2024-12905

References


[ 1 ] Bug #2355667 - CVE-2024-12905 yarnpkg: link following and path traversal via maliciously crafted tar file [epel-9] https://bugzilla.redhat.com/show_bug.cgi?id=2355667 [ 2 ] Bug #2355668 - CVE-2024-12905 yarnpkg: link following and path traversal via maliciously crafted tar file [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2355668 [ 3 ] Bug #2355669 - CVE-2024-12905 yarnpkg: link following and path traversal via maliciously crafted tar file [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2355669

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-e73ea121f5' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: yarnpkg
Product: Fedora 42
Version: 1.22.22
Release: 7.fc42
URL: https://github.com/yarnpkg/yarn
Summary: Fast, reliable, and secure dependency management.

Topics%20covered

Topics Covered

security advisory Fedora CVE fix package management path traversal yarnpkg

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here