Homepage

Link Following Affecting rh-nodejs8-nodejs-devel package, versions <0:8.16.0-1.el7

Severity

 Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.41% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-RHNODEJS8NODEJSDEVEL-4757098
  • published1 Nov 2021
  • disclosed30 Apr 2018
Report a new vulnerability Found a mistake?

Introduced: 30 Apr 2018

CVE-2018-20834  (opens in a new tab)
CWE-59  (opens in a new tab)

How to fix?

Upgrade RHEL:7 rh-nodejs8-nodejs-devel to version 0:8.16.0-1.el7 or higher.
This issue was patched in RHSA-2019:1821.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rh-nodejs8-nodejs-devel package and not the rh-nodejs8-nodejs-devel package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).