CVE-2018-20834: Improper Link Resolution Before File Access ('Link Following')
(updated )
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
References
- access.redhat.com/errata/RHSA-2019:1821
- github.com/advisories/GHSA-j44m-qm6p-hp7m
- github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d
- github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8
- github.com/npm/node-tar/commits/v2.2.2
- github.com/npm/node-tar/compare/58a8d43...a5f7779
- hackerone.com/reports/344595
- nvd.nist.gov/vuln/detail/CVE-2018-20834
- www.npmjs.com/advisories/803
Code Behaviors & Features
Detect and mitigate CVE-2018-20834 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →