In short
- CVE-2018-20834 is a HIGH (CVSS 7.5) vulnerability affecting tar (isaacs), tar.
- Chance of exploitation in the next 30 days (EPSS): 3.1%, higher than 87.9% of all vulnerabilities.
- Fix: update to 4.4.2, 2.2.2 or later.
| Package | Affected versions | Patched versions |
|---|
| tar | ≥ 3.0.0, < 4.4.2< 2.2.2
| 4.4.22.2.2
|
| tar npm | ≥ 3.0.0, < 4.4.2< 2.2.2
| 4.4.22.2.2
|
Description
Versions of tar prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.
Recommendation
For tar 4.x, upgrade to version 4.4.2 or later.
For tar 2.x, upgrade to version 2.2.2 or later.
NVD description
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free