CVE-2019-13173
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2019-13173 node-fstream 修正版: 1.0.12-1
参照URL
- patch github.com
- patch npmjs.com
- web lists.opensuse.org
- web lists.opensuse.org
- web usn.ubuntu.com