CVE-2018-20834
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 3.1%
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Produtos afetados
n/a · n/aReferências
https://access.redhat.com/errata/RHSA-2019:1821https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395dhttps://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8https://github.com/npm/node-tar/commits/v2.2.2https://github.com/npm/node-tar/compare/58a8d43...a5f7779https://hackerone.com/reports/344595https://nvd.nist.gov/vuln/detail/CVE-2018-20834