IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.2Yüksek

CVE-2026-24842node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

isaacs node-tar; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Yayım: (9 ay önce)

Açıklama

node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

Zayıflık türü (CWE): CWE-22CWE-59

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
isaacs node-tar < 7.5.7
isaacs tar < 7.5.7
jboss enterprise application platform eus 7.3 —
network observ optr 1.11 —
openshift devspaces 3.27 —
Red Hat Cryostat 4 —
Red Hat Logging Subsystem for Red Hat OpenShift all versions
Red Hat Multicluster Engine for Kubernetes —
Red Hat Network Observability (NETOBSERV) 1.11.0 all versions
Red Hat Red Hat 3scale API Management Platform 2 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 —
Red Hat Red Hat AMQ Broker 7 —
Red Hat Red Hat build of Apache Camel - HawtIO 4 —
Red Hat Red Hat Developer Hub all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Fuse 7 all versions
Red Hat Red Hat Hardened Images —
Red Hat Red Hat JBoss Enterprise Application Platform 7 —
Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8 —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack —
Red Hat Red Hat OpenShift AI (RHOAI) —
Red Hat Red Hat OpenShift Container Platform 4 all versions
Red Hat Red Hat Openshift Data Foundation 4 all versions
Red Hat Red Hat OpenShift Dev Spaces —
Red Hat Red Hat OpenShift Dev Spaces 3.27 all versions
Red Hat Red Hat Process Automation 7 —
Red Hat Red Hat Single Sign-On 7 —
Red Hat Red Hat Trusted Artifact Signer 1.3 all versions
trusted artifact signer 1.3 —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* < 7.5.7

Aynı üründe son açıklar — Red Hat Enterprise Linux

5.5Orta
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Yüksek
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…