Описание
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
A flaw was found in the way nodejs-tar, a Node.js module for reading and writing of tar archives, handled symbolic links when processing NPM packages. An attacker could potentially use this flaw to rewrite arbitrary files on the system.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Software Collections | nodejs010-nodejs-tar | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
The tar package before 2.0.0 for Node.js allows remote attackers to wr ...
ALT-PU-2016-1086: package `node` update to version 4.2.6-alt1
EPSS
4.3 Medium
CVSS2