Arbitrary File Overwrite in tar

高 7.5CVE-2018-20834 · GHSA-j44m-qm6p-hp7m · 30/04/2019 公開 · 17/06/2026 更新

要点

CVE-2018-20834 は tar (isaacs), tar に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：3.1%（全脆弱性の 87.9% より高い）。
対処：4.4.2, 2.2.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
tar isaacs	`≥ 3.0.0, < 4.4.2< 2.2.2`	`4.4.22.2.2`
tar npm	`≥ 3.0.0, < 4.4.2< 2.2.2`	`4.4.22.2.2`

概要

Versions of tar prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Recommendation

For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.

NVD の説明

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).