This repository was archived by the owner on Jul 24, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
This repository was archived by the owner on Jul 24, 2024. It is now read-only.
[Security] Vulnerability in tar #2625
Copy link
Copy link
Closed
Description
Do not open a PR. We appreciate the enthusiasm but the fix is more complicated than it appears. We're considering our options.
See https://www.npmjs.com/advisories/803
Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.
Caused by node-gyp. I guess this depends on nodejs/node-gyp#1714 being fixed first. As far as I can tell, to fix this node-sass needs to to upgrade to [email protected] once they've resolved the issue on their part.
Output from yarn audit:
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Arbitrary File Overwrite │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tar │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.4.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ node-sass │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ node-sass > node-gyp > tar │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/803 │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 16503
Severity: 1 High
pherris, lahmud, mistercorea, nlucero, ricardo-bemo and 112 more
Metadata
Metadata
Assignees
Labels
No labels