CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20990
https://notcve.org/view.php?id=CVE-2018-20990
An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive. Se descubrió un problema en el paquete (crate) tar versiones anteriores a 0.4.16 para Rust. Una sobrescritura arbitraria de archivos puede producirse por medio de un enlace simbólico o un enlace físico en un archivo TAR. • https://rustsec.org/advisories/RUSTSEC-2018-0002.html • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2018-20835
https://notcve.org/view.php?id=CVE-2018-20835
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. Fue encontrada una vulnerabilidad en tar-FS anterior a la versión 1.16.2. Existe un problema de sobrescritura de archivo arbitrario cuando se extrae un tarball que contiene un hardlink en un archivo que ya existe en el sistema, junto con un archivo sin formato con el mismo nombre que el hardlink. • https://github.com/ossf-cve-benchmark/CVE-2018-20835 https://github.com/mafintosh/tar-fs/commit/06672828e6fa29ac8551b1b6f36c852a9a3c58a2 https://github.com/mafintosh/tar-fs/compare/d590fc7...a35ce2f https://hackerone.com/reports/344595 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 2CVE-2018-20834 – nodejs-tar: Arbitrary file overwrites when extracting tarballs containing a hard-link
https://notcve.org/view.php?id=CVE-2018-20834
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2). Se detecto una vulnerabilidad en node-tar en versiones anteriores a la 4.4.2 (excluyendo la versión 2.2.2). • https://github.com/ossf-cve-benchmark/CVE-2018-20834 https://access.redhat.com/errata/RHSA-2019:1821 https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8 https://github.com/npm/node-tar/commits/v2.2.2 https://github.com/npm/node-tar/compare/58a8d43...a5f7779 https://hackerone.com/reports/344595 https://nvd.nist.gov/vuln/detail/CVE-2018-20834 https://access.redhat.com/security/cve&# • CWE-59: Improper Link Resolution Before File Access ('Link Following') •