REDHAT-BUG-2430538: High severity npm/node-tar vulnerability
node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-tarto a version that resolves this vulnerability.Fixed in 7.5.3
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2430538?
The severity of REDHAT-BUG-2430538 is high with a score of 7.
How do I fix REDHAT-BUG-2430538?
To fix REDHAT-BUG-2430538, update the node-tar library to version 7.5.3 or later.
What is the impact of REDHAT-BUG-2430538?
The impact of REDHAT-BUG-2430538 is that it allows malicious archives to bypass extraction root restrictions, leading to arbitrary file overwrite.
Which versions of node-tar are affected by REDHAT-BUG-2430538?
All versions of node-tar up to and including 7.5.2 are affected by REDHAT-BUG-2430538.
What does the default behavior of preservePaths in REDHAT-BUG-2430538 mean?
In REDHAT-BUG-2430538, the default behavior of preservePaths being false means that the library fails to sanitize linkpaths, creating a security risk.