Bug 1710570 (CVE-2019-13173)

Summary: CVE-2019-13173 nodejs-fstream: File overwrite in fstream.DirWriter() function
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ahardin, aos-bugs, bleanhar, bmontgom, ccoleman, cmacedo, dedgar, dfediuck, dffrench, drusso, eedri, eparis, hhorak, jburrell, jcantril, jgoulding, jmadigan, jokerman, jorton, jshepherd, mchappel, mgoldboi, michal.skrivanek, ngough, nodejs-sig, nstielau, omachace, pwright, sbonazzo, sgratch, sherold, sponnaga, tchollingsworth, thrcka, trepel, zsvetlik
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: nodejs-fstream 1.0.12 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-25 09:52:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1710571, 1710572, 1726550, 1726551, 1726552, 1840514, 1840515    
Bug Blocks: 1710573    

Description Pedro Sampaio 2019-05-15 19:32:54 UTC 
Affected versions of this package are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Upstream patch:

https://github.com/npm/fstream/commit/6a77d2fa6e1462693cf8e46f930da96ec1b0bb22

References:

https://www.npmjs.com/advisories/886
Comment 1 Pedro Sampaio 2019-05-15 19:33:25 UTC 
Created nodejs-fstream tracking bugs for this issue:

Affects: epel-all [bug 1710572]
Affects: fedora-all [bug 1710571]
Comment 2 Riccardo Schirone 2019-07-02 14:03:18 UTC 
External References:

https://www.npmjs.com/advisories/886
Comment 7 Jason Shepherd 2019-08-08 05:47:15 UTC 
This vulnerability is out of security support scope for the following product:

 * Red Hat Mobile Application Platform

 Please refer to https://access.redhat.com/support/policy/updates/rhmap for more details