Packages / tar / Security

HighVulnerabilityGHSA-j44m-qm6p-hp7mCVE-2018-20834Published 1 May 2019

Arbitrary File Overwrite in tar

Your version

Affected releases · tar

  • 4.x4.0.0 – 4.4.1Fixed in 4.4.2
  • 3.x3.0.0 – 3.2.3No fix on this line yet
  • 2.x2.0.0 – 2.2.1Fixed in 2.2.2
  • 1.x and older0.0.1 – 1.0.3No fix, no longer updated

On 4.x, the newest line:

npm install tar@4.4.2
Every release on a timeline
7.x

  1. Not affected

    7.0.0 – 7.5.22

    33 releases, latest

4.x

  1. Affected

    4.0.0 – 4.4.1

    13 releases

  2. Fixed

    4.4.2 – 4.4.19

    18 releases

3.x

  1. Affected

    3.0.0 – 3.2.3

    22 releases

2.x

  1. Affected

    2.0.0 – 2.2.1

    6 releases

  2. Fixed

    2.2.2

    1 release

1.x

  1. Affected

    1.0.0 – 1.0.3

    4 releases

0.x

  1. Affected

    0.0.1 – 0.1.20

    21 releases

154 stable releases of tar, oldest to newest, one row per major.

What happens

Versions of tar prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Recommendation

For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.