Alerts This Week
Warning Icon 1 485
Alerts This Week
Warning Icon 1 485

Ubuntu 22.04 LTS: 5847-1 Critical Grunt Security Issues

ubuntu
Calendar Grey February 7, 2023
Dist Ubuntu Esm H88
Patch addressing various security flaws impacting Grunt across Ubuntu distributions. Ensure your system is updated and fortified.
Several security issues were fixed in Grunt.

Summary

Several security issues were fixed in Grunt.

Software Description:

- grunt: JavaScript task runner/build system/maintainer tool

Details:

It was discovered that Grunt was not properly loading YAML files before

parsing them. An attacker could possibly use this issue to execute

arbitrary code. (CVE-2020-7729)

It was discovered that Grunt was not properly handling symbolic links

when performing file copy operations. An attacker could possibly use this

issue to expose sensitive information or execute arbitrary code.

(CVE-2022-0436)

It was discovered that there was a race condition in the Grunt file copy

function, which could lead to an arbitrary file write. An attacker could

possibly use this issue to perform a local privilege escalation attack or

to execute arbitrary code. (CVE-2022-1537)

Topics%20covered

Topics Covered

security advisory critical local privilege escalation arbitrary code execution Ubuntu grunt file copy issues

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
   grunt                           1.4.1-2ubuntu0.1~esm1

Ubuntu 20.04 LTS:
   grunt                           1.0.4-2ubuntu0.1~esm1

Ubuntu 18.04 LTS:
   grunt                           1.0.1-8ubuntu0.1+esm1

In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-5847-1

  CVE-2020-7729, CVE-2022-0436, CVE-2022-1537

Severity
critical
Lowest
Low
Medium
High
Critical

February 07, 2023

Topics%20covered

Topics Covered

security advisory critical local privilege escalation arbitrary code execution Ubuntu grunt file copy issues

Package Information

     

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here