CVE:CVE-2019-16776
CNNVD:CNNVD-201912-666
npm CLI是美国npm公司的一款软件包管理器。
npm CLI 6.13.3之前版本中存在路径遍历漏洞。攻击者可借助package.json文件的bin字段利用该漏洞访问node_modules文件夹之外的文件夹。
solution:Upgrade npmjs npm to a higher version than 6.13.3,and avoid the version (,6.13.3); Upgrade opensuse leap to a higher version than 15.1,and avoid the version 15.1; Upgrade oracle graalvm to a higher version than 19.3.0.2,and avoid the version 19.3.0.2; Upgrade fedoraproject fedora to a higher version than 31,and avoid the version 31; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade redhat enterprise_linux_eus to a higher version than 8.1,and avoid the version 8.1