Vulnerabilities found in tar 4.4.1

[ghardy-test]

CVE-2018-20834

Description: A vulnerability was found in node-tar before version 4.4.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
Discovery Date: 2019-07-22
CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score: 6.4

Exploitability score: 10.0
Impact score: 4.9

Vendors

• node-tar_project

References

• RHSA-2019:1821
• https://hackerone.com/reports/344595
• isaacs/node-tar@b0c5843
• isaacs/node-tar@58a8d43...a5f7779