CVE-2018-20834

Aliases:GHSA-j44m-qm6p-hp7m
Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 30 Apr 2019, 18:01
Last modified:05 Aug 2024, 12:12

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.0 (nvd)
EPSS Score
0.72% LOW
1% probability -0.04%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

30 Apr 2019, 18:01
Published
Vulnerability first disclosed
05 Aug 2024, 12:12
Last Modified
Vulnerability information updated

Description

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

CVSS Metrics

  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • v2.0•MEDIUM•Score: 6.4AV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS Trends

Current EPSS score: 0.72%• Percentile: 73%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • isaacs•tar

    < 2.2.2 | ≥ 3.0.0, < 4.4.2

  • node-tar_project•node-tar

    < 2.2.2 | ≥ 3.0.0, < 4.4.2

  • Npm•tar

    ≥ 3.0.0, < 4.4.2 | < 2.2.2

References (8)