CVE-2017-18869 Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
LowCVSS 2.5
EPSS 0.33%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm chownr(npm) | < 1.1.0 | 1.1.0 |
| debian/node-chownr(Debian:12) | < 1.1.1-1 | 1.1.1-1 |
| debian/node-chownr(Debian:13) | < 1.1.1-1 | 1.1.1-1 |
| debian/node-chownr(Debian:14) | < 1.1.1-1 | 1.1.1-1 |
| chownr project chownr | < 1.1.0 | 1.1.0 |
| ubuntu/node-chownr(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/node-chownr(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/node-chownr(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/node-chownr(Ubuntu:22.04) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com third-party-advisory
- bugs.debian.org third-party-advisory
- bugzilla.redhat.com permissions-required
- snyk.io exploit third-party-advisory
- github.com patch
- github.com patch
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2017-18869 vendor-advisory
- bugs.debian.org issue-tracking