USN-5847-1: Grunt vulnerabilities

Releases

• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• grunt - JavaScript task runner/build system/maintainer tool

Details

It was discovered that Grunt was not properly loading YAML files before
parsing them. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2020-7729)

It was discovered that Grunt was not properly handling symbolic links
when performing file copy operations. An attacker could possibly use this
issue to expose sensitive information or execute arbitrary code.
(CVE-2022-0436)

It was discovered that there was a race condition in the Grunt file copy
function, which could lead to an arbitrary file write. An attacker could
possibly use this issue to perform a local privilege escalation attack or
to execute arbitrary code. (CVE-2022-1537)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• grunt - 1.4.1-2ubuntu0.1~esm1
  Available with Ubuntu Pro

Ubuntu 20.04

• grunt - 1.0.4-2ubuntu0.1~esm1
  Available with Ubuntu Pro

Ubuntu 18.04

• grunt - 1.0.1-8ubuntu0.1+esm1
  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

• CVE-2020-7729
• CVE-2022-0436
• CVE-2022-1537

Related notices

• USN-4595-1: grunt