Vulnerabilites related to node-tar_project - node-tar
CVE-2018-20834 (GCVE-0-2018-20834)
Vulnerability from cvelistv5
Published
2019-04-30 18:01
Modified
2024-08-05 12:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
References
| ▼ | URL | Tags |
|---|---|---|
| https://hackerone.com/reports/344595 | x_refsource_MISC | |
| https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8 | x_refsource_MISC | |
| https://github.com/npm/node-tar/compare/58a8d43...a5f7779 | x_refsource_MISC | |
| https://access.redhat.com/errata/RHSA-2019:1821 | vendor-advisory, x_refsource_REDHAT | |
| https://nvd.nist.gov/vuln/detail/CVE-2018-20834 | x_refsource_MISC | |
| https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d | x_refsource_MISC | |
| https://github.com/npm/node-tar/commits/v2.2.2 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:12:27.376Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hackerone.com/reports/344595"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779"
},
{
"name": "RHSA-2019:1821",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1821"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/npm/node-tar/commits/v2.2.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-09-04T19:04:47",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/344595"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779"
},
{
"name": "RHSA-2019:1821",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1821"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/npm/node-tar/commits/v2.2.2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "[email protected]",
"ID": "CVE-2018-20834",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://hackerone.com/reports/344595",
"refsource": "MISC",
"url": "https://hackerone.com/reports/344595"
},
{
"name": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8",
"refsource": "MISC",
"url": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8"
},
{
"name": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779",
"refsource": "MISC",
"url": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779"
},
{
"name": "RHSA-2019:1821",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1821"
},
{
"name": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834",
"refsource": "MISC",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834"
},
{
"name": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d",
"refsource": "MISC",
"url": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d"
},
{
"name": "https://github.com/npm/node-tar/commits/v2.2.2",
"refsource": "MISC",
"url": "https://github.com/npm/node-tar/commits/v2.2.2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-20834",
"datePublished": "2019-04-30T18:01:58",
"dateReserved": "2019-04-30T00:00:00",
"dateUpdated": "2024-08-05T12:12:27.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2019-04-30 19:29
Modified
2024-11-21 04:02
Severity ?
Summary
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| node-tar_project | node-tar | * | |
| node-tar_project | node-tar | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:node-tar_project:node-tar:*:*:*:*:*:*:*:*",
"matchCriteriaId": "25114F61-BC5B-4B8E-B991-01EE8F6E8B1B",
"versionEndExcluding": "2.2.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:node-tar_project:node-tar:*:*:*:*:*:*:*:*",
"matchCriteriaId": "80C2038D-E008-44E4-89B9-210B0612BE3F",
"versionEndExcluding": "4.4.2",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2)."
},
{
"lang": "es",
"value": "Se detecto una vulnerabilidad en node-tar en versiones anteriores a la 4.4.2 (excluyendo la versi\u00f3n 2.2.2). Existe un problema de sobrescritura arbitraria de archivos cuando se extrae un tarball que contiene un enlace f\u00edsico a un archivo que ya existe en el sistema, junto con un archivo plano posterior con el mismo nombre que el enlace f\u00edsico. Este contenido de archivo simple reemplaza el contenido de archivo existente. Se ha aplicado un parche a node-tar v2.2.2)."
}
],
"id": "CVE-2018-20834",
"lastModified": "2024-11-21T04:02:16.243",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "[email protected]",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "[email protected]",
"type": "Primary"
}
]
},
"published": "2019-04-30T19:29:03.327",
"references": [
{
"source": "[email protected]",
"url": "https://access.redhat.com/errata/RHSA-2019:1821"
},
{
"source": "[email protected]",
"url": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d"
},
{
"source": "[email protected]",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8"
},
{
"source": "[email protected]",
"url": "https://github.com/npm/node-tar/commits/v2.2.2"
},
{
"source": "[email protected]",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779"
},
{
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/344595"
},
{
"source": "[email protected]",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2019:1821"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://github.com/npm/node-tar/commits/v2.2.2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/344595"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834"
}
],
"sourceIdentifier": "[email protected]",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "[email protected]",
"type": "Primary"
}
]
}