Описание
Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| azl3 tar 1.35-2 on Azure Linux 3.0 | ||
| azl3 tar 1.35-3 on Azure Linux 3.0 | - |
Показывать по
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
A flaw was found in GNU tar. When extracting an archive with the --one ...
EPSS
4.4 Medium
CVSS3