Yarn 后置链接漏洞

来源:snyk.io

链接：https://snyk.io/vuln/SNYK-JS-YARN-537806

来源:MISC

链接：https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/

来源:FEDORA

链接：https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITY5BC63CCC647DFNUQRQ5AJDKUKUNBI/

来源:github.com

链接：https://github.com/yarnpkg/yarn/issues/7761#issuecomment-565493023

来源:MISC

链接：https://github.com/yarnpkg/yarn/commit/039bafd74b7b1a88a53a54f8fa6fa872615e90e7

来源:REDHAT

链接：https://access.redhat.com/errata/RHSA-2020:0475

来源:FEDORA

链接：https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HIZW4NZVV5QY5WWGW2JRP3FHYKZ6ZJ5/

来源:access.redhat.com

链接：https://access.redhat.com/errata/RHSA-2020:0475

来源:www.auscert.org.au

链接：https://www.auscert.org.au/bulletins/ESB-2020.0485/

来源:vigilance.fr

链接：https://vigilance.fr/vulnerability/Node-js-Yarn-file-corruption-via-Package-Install-31567

来源:nvd.nist.gov

链接：https://nvd.nist.gov/vuln/detail/CVE-2019-10773