USN-5847-1: Grunt vulnerabilities
==========================================================================
Ubuntu Security Notice USN-5847-1
February 07, 2023
grunt vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in Grunt.
Software Description:
- grunt: JavaScript task runner/build system/maintainer tool
Details:
It was discovered that Grunt was not properly loading YAML files before
parsing them. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2020-7729)
It was discovered that Grunt was not properly handling symbolic links
when performing file copy operations. An attacker could possibly use this
issue to expose sensitive information or execute arbitrary code.
(CVE-2022-0436)
It was discovered that there was a race condition in the Grunt file copy
function, which could lead to an arbitrary file write. An attacker could
possibly use this issue to perform a local privilege escalation attack or
to execute arbitrary code. (CVE-2022-1537)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
grunt 1.4.1-2ubuntu0.1~esm1
Ubuntu 20.04 LTS:
grunt 1.0.4-2ubuntu0.1~esm1
Ubuntu 18.04 LTS:
grunt 1.0.1-8ubuntu0.1+esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5847-1
CVE-2020-7729, CVE-2022-0436, CVE-2022-1537
Package Information:
https://launchpad.net/ubuntu/+source/grunt/1.4.1-2ubuntu0.1~esm1
https://launchpad.net/ubuntu/+source/grunt/1.0.4-2ubuntu0.1~esm1
https://launchpad.net/ubuntu/+source/grunt/1.0.1-8ubuntu0.1+esm1
A Grunt security update has been released for Ubuntu Linux 18.04 LTS, 20.04 LTS, and 22.04 LTS.
