dancefinder/dancefinder-app
5
0
Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases Activity

Improper Input Validation in tar-fs #38

New Issue
Closed
opened 2023-11-01 04:46:55 +00:00 by argoyle · 0 comments
argoyle commented 2023-11-01 04:46:55 +00:00 (Migrated from gitlab.com)
Copy Link
Copy Source

⚠️ dependabot-gitlab has detected security vulnerability for tar-fs in path: /, manifest_file: /package.json but was unable to update it! ⚠️

Package Severity Affected versions Patched versions IDs
tar-fs (NPM) HIGH < 1.16.2 1.16.2 GHSA-x2mc-8fgj-3wmr,CVE-2018-20835

Description

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.

References

⚠️ `dependabot-gitlab` has detected security vulnerability for `tar-fs` in path: `/`, manifest_file: `/package.json` but was unable to update it! ⚠️ * https://github.com/advisories/GHSA-x2mc-8fgj-3wmr | Package | Severity | Affected versions | Patched versions | IDs | |--------------|----------|-------------------|------------------|----------------------------------------| | tar-fs (NPM) | HIGH | < 1.16.2 | 1.16.2 | `GHSA-x2mc-8fgj-3wmr`,`CVE-2018-20835` | # Description A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. # References * https://nvd.nist.gov/vuln/detail/CVE-2018-20835 * https://github.com/mafintosh/tar-fs/commit/06672828e6fa29ac8551b1b6f36c852a9a3c58a2 * https://hackerone.com/reports/344595 * https://github.com/mafintosh/tar-fs/compare/d590fc7...a35ce2f * https://github.com/advisories/GHSA-x2mc-8fgj-3wmr
argoyle (Migrated from gitlab.com) closed this issue 2024-02-06 06:53:26 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
dependencies
Pull requests that update a dependency file
 docker
javascript
security
Pull requests that address a security vulnerability
 severity:critical
severity:high
severity:low
severity:moderate
No labels security severity:high
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
argoyle (Joakim Olsson) buildtools (Buildtools) kubernetes (Kubernetes) releaser (Unbound Releaser) renovate (Renovate Bot)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dancefinder/dancefinder-app#38