CVE-2018-20834: High severity Node-tar Project Node-tar vulnerability
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Other sources
A vulnerability was found in nodejs-tar before version 4.4.2. An Arbitrary File Overwrite when extracting tarballs containing a hard-link to a file that already exists in the system, and a file that matches the hard-link may overwrite system's files with the contents of the extracted file.
References: https://hackerone.com/reports/344595
Upstream Patch: https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8
— Red Hat
Versions of tar prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.
Recommendation
For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20834?
CVE-2018-20834 has been classified with high severity due to the potential for arbitrary file overwrites.
How do I fix CVE-2018-20834?
To fix CVE-2018-20834, upgrade node-tar to version 4.4.2 or higher, or to version 2.2.2.
What software is affected by CVE-2018-20834?
CVE-2018-20834 affects node-tar versions prior to 4.4.2 and version 2.2.2.
What is the nature of the vulnerability in CVE-2018-20834?
CVE-2018-20834 is an arbitrary file overwrite vulnerability that occurs when extracting tarballs with conflicting hardlinks.
Is there a specific condition when CVE-2018-20834 can be exploited?
CVE-2018-20834 can be exploited when a tarball contains a hardlink to an existing file and a later plain file with the same name.