IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.2Yüksek

CVE-2026-29786node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

isaacs node-tar; Red Hat Cryostat 4; Red Hat Logging Subsystem for Red Hat OpenShift; Red Hat Network Observability Operator Yayım: (8 ay önce)

Açıklama

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

Zayıflık türü (CWE): CWE-22CWE-59

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
isaacs node-tar < 7.5.10
isaacs tar < 7.5.10
Red Hat Cryostat 4 —
Red Hat Logging Subsystem for Red Hat OpenShift —
Red Hat Network Observability Operator —
Red Hat Red Hat 3scale API Management Platform 2 —
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 —
Red Hat Red Hat AMQ Broker 7 —
Red Hat Red Hat build of Apache Camel - HawtIO 4 —
Red Hat Red Hat Enterprise Linux 10 —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux 9 —
Red Hat Red Hat Fuse 7 —
Red Hat Red Hat JBoss Enterprise Application Platform 7 —
Red Hat Red Hat JBoss Enterprise Application Platform 8 —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack —
Red Hat Red Hat OpenShift AI (RHOAI) —
Red Hat Red Hat OpenShift Container Platform 4 —
Red Hat Red Hat Openshift Data Foundation 4 —
Red Hat Red Hat OpenShift Dev Spaces —
Red Hat Red Hat Process Automation 7 —
Red Hat Red Hat Single Sign-On 7 —
Red Hat Red Hat Trusted Artifact Signer —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* < 7.5.10

Aynı üründe son açıklar — Red Hat Enterprise Linux

5.5Orta
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Yüksek
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…