GHSA-j44m-qm6p-hp7m CVE-2018-20834
Arbitrary File Overwrite in tar
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 3.15%
- Chance of exploitation in the next 30 days. Higher than 87.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
4.4.2- Upgrade tar to this version or later
Description
Versions of tar prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.
Recommendation
For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
tar npm → 4.4.2
- npm
npm install tar@4.4.2- yarn
yarn add tar@4.4.2- pnpm
pnpm add tar@4.4.2
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-r292-9mhp-454m node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection | High | Also affects tar |
| GHSA-gvwx-54wh-qm9j node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records | Medium | Also affects tar |
| GHSA-8x88-c5mf-7j5w node-tar: Negative tar entry size causes infinite loop in archive replace | High | Also affects tar |
| GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input | High | Also affects tar |
| GHSA-w8wr-v893-vjvp node-tar: Process crash via PAX numeric path type confusion | High | Also affects tar |
| GHSA-vmf3-w455-68vh node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling) | Medium | Also affects tar |
| GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath | Medium | Also affects tar |
| GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath | Medium | Also affects tar |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor