CVE-2018-20834
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-20834?
CVE-2018-20834 has been classified with high severity due to the potential for arbitrary file overwrites.
How do I fix CVE-2018-20834?
To fix CVE-2018-20834, upgrade node-tar to version 4.4.2 or higher, or to version 2.2.2.
What software is affected by CVE-2018-20834?
CVE-2018-20834 affects node-tar versions prior to 4.4.2 and version 2.2.2.
What is the nature of the vulnerability in CVE-2018-20834?
CVE-2018-20834 is an arbitrary file overwrite vulnerability that occurs when extracting tarballs with conflicting hardlinks.
Is there a specific condition when CVE-2018-20834 can be exploited?
CVE-2018-20834 can be exploited when a tarball contains a hardlink to an existing file and a later plain file with the same name.