Bug 1209501 (CVE-2015-8860) - CVE-2015-8860 nodejs-tar: insecure processing of symbolic links during package processing
Summary: CVE-2015-8860 nodejs-tar: insecure processing of symbolic links during packag...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-8860
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1209503 1209504
Blocks: 1209502
TreeView+ depends on / blocked
 
Reported: 2015-04-07 13:49 UTC by Vasyl Kaigorodov
Modified: 2021-10-21 00:44 UTC (History)
4 users (show)

Fixed In Version: npm 2.7.5, tar@nodejs 2.0.0
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way nodejs-tar, a Node.js module for reading and writing of tar archives, handled symbolic links when processing NPM packages. An attacker could potentially use this flaw to rewrite arbitrary files on the system.
Clone Of:
Environment:
Last Closed: 2021-10-21 00:44:07 UTC
Embargoed:


Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-04-07 13:49:22 UTC
A flaw was found in the way nodejs-tar, a Node.js module for reading and writing of tar archives, handled symbolic links when processing npm packages. An attacker could potentially use this flaw to rewrite arbitrary files on the system.

The fix normalizes symbolic links that point to targets outside the extraction root. This prevents packages containing symbolic links from overwriting targets outside the expected paths for a package.

Upstream announcement: https://github.com/npm/npm/releases/tag/v2.7.5
Upstream fix: https://github.com/npm/npm/commit/300834e91a4e2a95fb7fb59c309e7c3fc91d2312

Comment 1 Vasyl Kaigorodov 2015-04-07 13:51:37 UTC
Created nodejs-tar tracking bugs for this issue:

Affects: fedora-all [bug 1209503]
Affects: epel-all [bug 1209504]

Comment 4 Andrej Nemec 2016-04-21 12:00:18 UTC
CVE assignment:

http://seclists.org/oss-sec/2016/q2/122

External references:

https://nodesecurity.io/advisories/57


Note You need to log in before you can comment on or make changes to this bug.