GitHub Advisoryadvisory · crates.io

GHSA-2367-c296-3mp2 Arbitrary file overwrite in tar-rs

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2018-20990
Ecosystem
crates.io
Packages
tar
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-59
Reviewed
2021-08-19

Affected packages

• crates.io tar: < 0.4.16 → fixed in 0.4.16

Description

When unpacking a tarball with the unpack_in-family of functions it's intended that only files within the specified directory are able to be written. Tarballs with hard links or symlinks, however, can be used to overwrite any file on the filesystem. Tarballs can contain multiple entries for the same file. A tarball which first contains an entry for a hard link or symlink pointing to any file on the filesystem will have the link created, and then afterwards if the same file is listed in the tarball the hard link will be rewritten and any file can be rewritten on the filesystem.

Related

Alias · CVE (1)

  • CVE-2018-20990 An issue was discovered in the tar crate before 0.4.16 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References