CVE-2018-20834GHSA-J44M-QM6P-HP7M
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2).
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.4.2, 2.2.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Timeline
- CVE published
- Record last updated
Affected versions
- n/a n/a
Version range not reported
- tarnpm
From 3.0.0 · fixed in 4.4.2
- tarnpm
fixed in 2.2.2