CVE-2018-20834

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-20834
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20834.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-20834
Aliases
Related
Published
2019-04-30T19:29:03Z
Modified
2024-09-18T02:59:24.264691Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

References

Affected packages

Debian:11 / node-tar

Package

Name
node-tar
Purl
pkg:deb/debian/node-tar?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.4.4+ds1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / node-tar

Package

Name
node-tar
Purl
pkg:deb/debian/node-tar?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.4.4+ds1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / node-tar

Package

Name
node-tar
Purl
pkg:deb/debian/node-tar?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.4.4+ds1-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/isaacs/node-tar

Affected ranges

Type
GIT
Repo
https://github.com/isaacs/node-tar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d
Fixed
b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8
Type
GIT
Repo
https://github.com/npm/node-tar
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
523c5c7fef48b10811fccd12b42803c61b6aead8

Affected versions

0.*

0.1.0
0.1.10
0.1.11
0.1.12
0.1.13
0.1.2
0.1.3
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9

v0.*

v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.20

v1.*

v1.0.0
v1.0.1
v1.0.2
v1.0.3

v2.*

v2.0.0
v2.0.1
v2.1.0
v2.1.1
v2.2.1

v3.*

v3.0.0
v3.0.1
v3.1.0
v3.1.1
v3.1.10
v3.1.11
v3.1.12
v3.1.13
v3.1.14
v3.1.15
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.1.8
v3.1.9
v3.2.0

v4.*

v4.0.0
v4.0.1
v4.0.2
v4.1.0
v4.1.1
v4.1.2
v4.2.0
v4.3.0
v4.3.1
v4.3.2
v4.3.3
v4.4.0
v4.4.1