CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.

• CWE-347

• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-FiredThird Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfThird Party Advisory
• https://github.com/yarnpkg/website/commits/masterThird Party Advisory
• https://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory
• http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2019/Apr/38Mailing List, Third Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-FiredThird Party Advisory
• https://github.com/RUB-NDS/Johnny-You-Are-Fired/blob/master/paper/johnny-fired.pdfThird Party Advisory
• https://github.com/yarnpkg/website/commits/masterThird Party Advisory
• https://www.openwall.com/lists/oss-security/2019/04/30/4Mailing List, Third Party Advisory

Published

May 16, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12550When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is c…
• CVE-2018-12551When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is c…
• CVE-2018-12552Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12553Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12554Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12555Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12557An issue was discovered in Zuul 3.x before 3.1.0. If nodes b…
• CVE-2018-12558The parse() method in the Email::Address module through 1.90…
• CVE-2018-12559An issue was discovered in the cantata-mounter D-Bus service…
• CVE-2018-1256Spring Cloud SSO Connector, version 2.1.2, contains a regres…8.1
• CVE-2018-12560An issue was discovered in the cantata-mounter D-Bus service…
• CVE-2018-12561An issue was discovered in the cantata-mounter D-Bus service…