HighGHSA-j44m-qm6p-hp7mCVE-2018-20834
Arbitrary File Overwrite in tar
Published 1 May 2019 · Updated 29 Nov 2023
Affected packages
tarnpm
- Affected
- >=3.0.0 <4.4.2
- Fixed in
- 4.4.2
Update to the fixed version for your release line, for example:
npm install tar@4.4.2tarnpm
- Affected
- <2.2.2
- Fixed in
- 2.2.2
Update to the fixed version for your release line, for example:
npm install tar@2.2.2Details
Versions of tar prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.
Recommendation
For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.
Is GHSA-j44m-qm6p-hp7m in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected tar, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2018-20834
- Linkgithub.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d
- Linkgithub.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8
- Linkhackerone.com/reports/344595
- Linkaccess.redhat.com/errata/RHSA-2019:1821
- Packagegithub.com/isaacs/node-tar
- Linkgithub.com/npm/node-tar/commits/v2.2.2
- Linkgithub.com/npm/node-tar/compare/58a8d43...a5f7779
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.