cve-2018-20834
Vulnerability from cvelistv5
Published
2019-04-30 18:01
Modified
2024-08-05 12:12
Severity ?
Summary
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
References
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2019:1821
cve@mitre.orghttps://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d
cve@mitre.orghttps://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8Patch, Third Party Advisory
cve@mitre.orghttps://github.com/npm/node-tar/commits/v2.2.2
cve@mitre.orghttps://github.com/npm/node-tar/compare/58a8d43...a5f7779Patch, Third Party Advisory
cve@mitre.orghttps://hackerone.com/reports/344595Exploit, Third Party Advisory
cve@mitre.orghttps://nvd.nist.gov/vuln/detail/CVE-2018-20834
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:1821
af854a3a-2127-422b-91ae-364da2661108https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d
af854a3a-2127-422b-91ae-364da2661108https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/npm/node-tar/commits/v2.2.2
af854a3a-2127-422b-91ae-364da2661108https://github.com/npm/node-tar/compare/58a8d43...a5f7779Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/344595Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://nvd.nist.gov/vuln/detail/CVE-2018-20834
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:12:27.376Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/344595"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779"
          },
          {
            "name": "RHSA-2019:1821",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:1821"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/npm/node-tar/commits/v2.2.2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-04T19:04:47",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/344595"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779"
        },
        {
          "name": "RHSA-2019:1821",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:1821"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/npm/node-tar/commits/v2.2.2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20834",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/344595",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/344595"
            },
            {
              "name": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8",
              "refsource": "MISC",
              "url": "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8"
            },
            {
              "name": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779",
              "refsource": "MISC",
              "url": "https://github.com/npm/node-tar/compare/58a8d43...a5f7779"
            },
            {
              "name": "RHSA-2019:1821",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:1821"
            },
            {
              "name": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834",
              "refsource": "MISC",
              "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20834"
            },
            {
              "name": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d",
              "refsource": "MISC",
              "url": "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d"
            },
            {
              "name": "https://github.com/npm/node-tar/commits/v2.2.2",
              "refsource": "MISC",
              "url": "https://github.com/npm/node-tar/commits/v2.2.2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20834",
    "datePublished": "2019-04-30T18:01:58",
    "dateReserved": "2019-04-30T00:00:00",
    "dateUpdated": "2024-08-05T12:12:27.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-20834\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-04-30T19:29:03.327\",\"lastModified\":\"2024-11-21T04:02:16.243\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).\"},{\"lang\":\"es\",\"value\":\"Se detecto una vulnerabilidad en node-tar en versiones anteriores a la 4.4.2 (excluyendo la versi\u00f3n 2.2.2). Existe un problema de sobrescritura arbitraria de archivos cuando se extrae un tarball que contiene un enlace f\u00edsico a un archivo que ya existe en el sistema, junto con un archivo plano posterior con el mismo nombre que el enlace f\u00edsico. Este contenido de archivo simple reemplaza el contenido de archivo existente. Se ha aplicado un parche a node-tar v2.2.2).\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:P\",\"baseScore\":6.4,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-59\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:node-tar_project:node-tar:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.2.2\",\"matchCriteriaId\":\"25114F61-BC5B-4B8E-B991-01EE8F6E8B1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:node-tar_project:node-tar:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0.0\",\"versionEndExcluding\":\"4.4.2\",\"matchCriteriaId\":\"80C2038D-E008-44E4-89B9-210B0612BE3F\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1821\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/npm/node-tar/commits/v2.2.2\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/npm/node-tar/compare/58a8d43...a5f7779\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://hackerone.com/reports/344595\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://nvd.nist.gov/vuln/detail/CVE-2018-20834\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1821\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/npm/node-tar/commits/v2.2.2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/npm/node-tar/compare/58a8d43...a5f7779\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://hackerone.com/reports/344595\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://nvd.nist.gov/vuln/detail/CVE-2018-20834\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.