GHSA-2367-c296-3mp2 CVE-2018-20990 RUSTSEC-2018-0002
Arbitrary file overwrite in tar-rs
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 1.68%
- Chance of exploitation in the next 30 days. Higher than 76.88% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
0.4.16- Upgrade tar to this version or later
Description
When unpacking a tarball with the unpack_in-family of functions it's intended that only files within the specified directory are able to be written. Tarballs with hard links or symlinks, however, can be used to overwrite any file on the filesystem. Tarballs can contain multiple entries for the same file. A tarball which first contains an entry for a hard link or symlink pointing to any file on the filesystem will have the link created, and then afterwards if the same file is listed in the tarball the hard link will be rewritten and any file can be rewritten on the filesystem.
Affected versions
crates.io
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
tar crates.io → 0.4.16
- cargo
cargo update -p tar --precise 0.4.16
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-3pv8-6f4r-ffg2 tar has a PAX header desynchronization issue | Medium | Also affects tar |
| GHSA-gchp-q4r4-x4ff tar-rs incorrectly ignores PAX size headers if header size is nonzero | High | Also affects tar |
| GHSA-j4xf-2g29-59ph tar-rs `unpack_in` can chmod arbitrary directories by following symlinks | Medium | Also affects tar |
| GHSA-62jx-8vmh-4mcw Links in archive can create arbitrary directories | High | Also affects tar |
| GHSA-hjqx-j4rw-g7xv zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. | High | Same weakness, CWE-59 |
| GHSA-4vjg-vx72-qq4g systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net | Low | Same weakness, CWE-59 |
| GHSA-9j6q-wvj5-jgjg filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker | Low | Same weakness, CWE-59 |
| GHSA-j8f7-rjxc-mr56 filelock: ReadWriteLock follows a symlink at the lock path into SQLite | Medium | Same weakness, CWE-59 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor