CVE-2017-18869

ADVISORY - github

Summary

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

EPSS Score⁠: 0.00123 (0.325)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-367⁠

Time-of-check Time-of-use (TOCTOU) Race Condition

ADVISORY - github

CWE-367⁠

Time-of-check Time-of-use (TOCTOU) Race Condition

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-367⁠

Time-of-check Time-of-use (TOCTOU) Race Condition

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

CWE-367⁠

Time-of-check Time-of-use (TOCTOU) Race Condition

Impacted images

Advisories

Sign in to Docker Scout

See which of your images are affected by this CVE and how to fix them by signing into Docker Scout.