GHSA-gfjr-3jmm-4g9v

Source

https://github.com/advisories/GHSA-gfjr-3jmm-4g9v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-gfjr-3jmm-4g9v/GHSA-gfjr-3jmm-4g9v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gfjr-3jmm-4g9v

Aliases

CVE-2015-8860

Published

2017-10-24T18:33:36Z

Modified

2023-11-08T03:58:03.745416Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Symlink Arbitrary File Overwrite in tar

Details

Versions of tar prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because tar does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.

Recommendation

Update to version 2.0.0 or later

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T21:37:06Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-59"
    ]
}

References

Affected packages

npm / tar

Package

Name: tar; View open source insights on deps.dev
Purl: pkg:npm/tar

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.0