{"id":54062,"date":"2019-12-17T00:00:00","date_gmt":"2019-12-16T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa"},"modified":"2020-02-18T14:02:02","modified_gmt":"2020-02-18T11:02:02","slug":"uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa","title":{"rendered":"En s\u00e5rbarhet i NPM som till\u00e5ter \u00e4ndring av godtyckliga filer vid installation av ett paket","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I uppdateringen av paketf\u00f6rvaltaren NPM 6.13.4, som ing\u00e5r i leveransen av Node.js och anv\u00e4nds f\u00f6r distribution av moduler p\u00e5 JavaScript, l\u00f6sta<\/a><\/noindex> tre s\u00e5rbarheter (CVE-2019-16775<\/a><\/noindex>, CVE-2019-16776<\/a><\/noindex> och CVE-2019-16777<\/a><\/noindex>), som g\u00f6r det m\u00f6jligt att modifiera eller skriva \u00f6ver godtyckliga systemfiler vid installationen av ett paket f\u00f6rberett av en angripare. Som en \u00e5tg\u00e4rd f\u00f6r att kringg\u00e5 skyddet kan installationen g\u00f6ras med alternativet «—ignore-scripts», vilket f\u00f6rhindrar att inbyggda paketbehandlare k\u00f6rs. Utvecklarna av NPM har analyserat de paket som finns i f\u00f6rr\u00e5det och har inte funnit n\u00e5gra tecken p\u00e5 att de uppt\u00e4ckta problemen har anv\u00e4nts f\u00f6r att utf\u00f6ra attacker.<\/p>\n

  • CVE-2019-16777 i LibreSSL.<\/a><\/noindex> i versioner f\u00f6re 6.13.4 och till\u00e5ter \u00f6verskrivning av systemexekverbara filer under den globala installationen av paketet. Endast filer i den m\u00e5lmapparna d\u00e4r de exekverbara filerna installeras kan bli manipulerade (vanligtvis \/usr\/local\/bin).\n
  • CVE-2019-16775<\/a><\/noindex> och CVE-2019-16776<\/a><\/noindex> visar sig i versioner innan 6.13.3 och g\u00f6r det m\u00f6jligt att skriva en godtycklig fil genom att skapa en symbolisk l\u00e4nk till filer utanf\u00f6r katalogen f\u00f6r moduler (node_modules) eller genom manipulerande med f\u00e4ltet bin i package.json (i f\u00e4ltet bin till\u00e4ts anv\u00e4ndning av v\u00e4gar med «\\\/..\\\/»).\n

    <\/a><\/noindex><\/p>\n

    K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 NPM 6.13.4, \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 Node.js \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 JavaScript, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-16775, CVE-2019-16776 \u0438 CVE-2019-16777), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 «—ignore-scripts», \u0437\u0430\u043f\u0440\u0435\u0449\u0430\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u044b \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 NPM […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54062","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i NPM som till\u00e5ter \u00e4ndring av godtyckliga filer vid installation av paket | ProHoster","description":"I uppdateringen av paketf\u00f6rvaltaren NPM 6.13.4, som ing\u00e5r i leveransen av Node.js och anv\u00e4nds f\u00f6r distribution av moduler p\u00e5 JavaScript,","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NPM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 NPM 6.13.4, \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 Node.js \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 JavaScript,","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-16T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54062","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:12:24","updated":"2026-01-24 09:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/54062","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=54062"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/54062\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=54062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=54062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=54062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}