GitHub Advisoryadvisory · npm

GHSA-j44m-qm6p-hp7m Arbitrary File Overwrite in tar

HIGH Published 2019-05-01 Modified 2023-11-29 Official page ↗
Aliases
CVE-2018-20834
Ecosystem
npm
Packages
tar
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-59
Reviewed
2019-05-01

Affected packages

• npm tar: >= 3.0.0, < 4.4.2 → fixed in 4.4.2 • npm tar: < 2.2.2 → fixed in 2.2.2

Description

Versions of `tar` prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. Recommendation For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.

Related

Alias · CVE (1)

  • CVE-2018-20834 A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). vulnerability

Weakness · CWE (1)

  • CWE-59 Improper Link Resolution Before File Access weakness

References