CVE-2018-20834
N/A
Published: April 30, 2019 at 06:01 PM UTC
Updated: June 17, 2026 at 01:53 AM UTC
1 product affected across 1 vendorTar
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 3%
Description
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (7)
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:1821x_refsource_MISC
Source: [email protected]
https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395dx_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/npm/node-tar/compare/58a8d43...a5f7779x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://hackerone.com/reports/344595Quick Info
StatusMODIFIED
CWE
CWE-59
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card