Arbitrary File Overwrite in tar

CAO 7.5CVE-2018-20834 · GHSA-j44m-qm6p-hp7m · Công bố 30/04/2019 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2018-20834 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng tar (isaacs), tar.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 3.1%, cao hơn 87.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.4.2, 2.2.2 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
tar isaacs	`≥ 3.0.0, < 4.4.2< 2.2.2`	`4.4.22.2.2`
tar npm	`≥ 3.0.0, < 4.4.2< 2.2.2`	`4.4.22.2.2`

Mô tả

Versions of tar prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Recommendation

For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.

Mô tả của NVD

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).