PT-2019-10267 · Npm · Tar-Fs

Max · Publicado 2019-04-30 · Atualizado 2019-05-03 · CVE-2018-20835

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: tar-fs versions prior to 1.16.2

Description: A vulnerability exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink, allowing an Arbitrary File Overwrite issue. This occurs because the plain file content replaces the existing file content.

Recommendations: For versions prior to 1.16.2, update to version 1.16.2 or later to resolve the issue.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-20835

GHSA-X2MC-8FGJ-3WMR

Produtos afetados

Tar-Fs

Referências · 6

• 🔥 https://hackerone.com/reports/344595 · Exploit
• https://github.com/mafintosh/tar-fs/commit/06672828e6fa29ac8551b1b6f36c852a9a3c58a2 · Correção
• https://github.com/mafintosh/tar-fs/compare/d590fc7...a35ce2f · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-20835 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-20835 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-x2mc-8fgj-3wmr · Aviso do Fabricante