It was discovered that there was a potential path-traversal vulnerability in GruntJS, a multipurpose task runner and build system tool. This could have been exploited via malicious symlinks. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3386-1
Several security issues were fixed in Grunt.. =========================================================================Ubuntu Security Notice USN-5847-1 February 07, 2023 grunt vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in Grunt. Software Description: - grunt: JavaScript task runner/build system/maintainer tool Details: It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-7729) It was discovered that Grunt was not properly handling symbolic links when performing file copy operations. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. (CVE-2022-0436) It was discovered that there was a race condition in the Grunt file copy function, which could lead to an arbitrary file write. An attacker could possibly use this issue to perform a local privilege escalation attack or to execute arbitrary code. (CVE-2022-1537) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS: grunt 1.4.1-2ubuntu0.1~esm1 Ubuntu 20.04 LTS: grunt 1.0.4-2ubuntu0.1~esm1 Ubuntu 18.04 LTS: grunt 1.0.1-8ubuntu0.1+esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-5847-1 CVE-2020-7729, CVE-2022-0436, CVE-2022-1537 Package Information: . Patch addressing various security flaws impacting Grunt across Ubuntu distributions. Ensure your system is updated and fortified..Grunt Issues, Ubuntu Updates, JavaScript Security. . Severity: Critical. LinuxSecurity.com Team
It was discovered that there was a arbitrary code execution vulnerability in grunt, a Javascript task runner. This was possible due to the unsafe loading of YAML documents. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2368-1
Get the latest Linux and open source security news straight to your inbox.