---
title: "GHSA-j44m-qm6p-hp7m: Arbitrary File Overwrite in tar"
description: "High severity. Arbitrary File Overwrite in tar. Affects tar; fixed in 4.4.2."
url: https://inlinr.com/advisories/GHSA-j44m-qm6p-hp7m
lang: en
---

[Packages](https://inlinr.com/packages) / [tar](https://inlinr.com/packages/tar) / [Security](https://inlinr.com/packages/tar/security)

High Vulnerability GHSA-j44m-qm6p-hp7m CVE-2018-20834 Published 1 May 2019

# Arbitrary File Overwrite in tar

Your version 

Affected releases · [tar](https://inlinr.com/packages/tar)

- 4.x 4.0.0 – 4.4.1 Fixed in 4.4.2
- 3.x 3.0.0 – 3.2.3 No fix on this line yet
- 2.x 2.0.0 – 2.2.1 Fixed in 2.2.2
- 1.x and older 0.0.1 – 1.0.3 No fix, no longer updated

On 4.x, the newest line:

```
npm install tar@4.4.2
```

Every release on a timeline

7.x 

1. Not affected

7.0.0 – 7.5.22  
33 releases, latest

4.x 

1. Affected

4.0.0 – 4.4.1  
13 releases
2. Fixed

4.4.2 – 4.4.19  
18 releases

3.x 

1. Affected

3.0.0 – 3.2.3  
22 releases

2.x 

1. Affected

2.0.0 – 2.2.1  
6 releases
2. Fixed

2.2.2  
1 release

1.x 

1. Affected

1.0.0 – 1.0.3  
4 releases

0.x 

1. Affected

0.0.1 – 0.1.20  
21 releases

154 stable releases of tar, oldest to newest, one row per major.

## What happens

Versions of `tar` prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Recommendation

For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.2 or later.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: high
- **Availability**: none

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:H/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-20834 "https://nvd.nist.gov/vuln/detail/CVE-2018-20834")  
nvd.nist.gov/vuln/detail/CVE-2018-20834
- [Fix commit](https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d "https://github.com/npm/node-tar/commit/7ecef07da6a9e72cc0c4d0c9c6a8e85b6b52395d")  
7ecef07
- [Fix commit](https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8 "https://github.com/npm/node-tar/commit/b0c58433c22f5e7fe8b1c76373f27e3f81dcd4c8")  
b0c5843
- [Reference](https://hackerone.com/reports/344595 "https://hackerone.com/reports/344595")  
hackerone.com/reports/344595
- [Reference](https://access.redhat.com/errata/RHSA-2019:1821 "https://access.redhat.com/errata/RHSA-2019:1821")  
access.redhat.com/errata/RHSA-2019:1821
- [Package](https://github.com/isaacs/node-tar "https://github.com/isaacs/node-tar")  
github.com/isaacs/node-tar
- [Reference](https://github.com/npm/node-tar/commits/v2.2.2 "https://github.com/npm/node-tar/commits/v2.2.2")  
github.com/npm/node-tar/commits/v2.2.2
- [Reference](https://github.com/npm/node-tar/compare/58a8d43...a5f7779 "https://github.com/npm/node-tar/compare/58a8d43...a5f7779")  
58a8d43...a5f7779