[USN-5847-1] Grunt vulnerabilities

[Camila Camargo de Matos]

==========================================================================
Ubuntu Security Notice USN-5847-1
February 07, 2023

grunt vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

Several security issues were fixed in Grunt.

Software Description:
- grunt: JavaScript task runner/build system/maintainer tool

Details:

It was discovered that Grunt was not properly loading YAML files before
parsing them. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2020-7729)

It was discovered that Grunt was not properly handling symbolic links
when performing file copy operations. An attacker could possibly use this
issue to expose sensitive information or execute arbitrary code.
(CVE-2022-0436)

It was discovered that there was a race condition in the Grunt file copy
function, which could lead to an arbitrary file write. An attacker could
possibly use this issue to perform a local privilege escalation attack or
to execute arbitrary code. (CVE-2022-1537)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
   grunt                           1.4.1-2ubuntu0.1~esm1

Ubuntu 20.04 LTS:
   grunt                           1.0.4-2ubuntu0.1~esm1

Ubuntu 18.04 LTS:
   grunt                           1.0.1-8ubuntu0.1+esm1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-5847-1
   CVE-2020-7729, CVE-2022-0436, CVE-2022-1537

Package Information:
   https://launchpad.net/ubuntu/+source/grunt/1.4.1-2ubuntu0.1~esm1
   https://launchpad.net/ubuntu/+source/grunt/1.0.4-2ubuntu0.1~esm1
   https://launchpad.net/ubuntu/+source/grunt/1.0.1-8ubuntu0.1+esm1


-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20230207/aab847e5/attachment-0001.sig>