CVE-2019-13173: Arbitrary file overwrite

July 2, 2019 (updated August 13, 2019)

fstream is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system’s file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

References

nvd.nist.gov/vuln/detail/CVE-2019-13173
www.npmjs.com/advisories/886

Code Behaviors & Features

Detect and mitigate CVE-2019-13173 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →