CVE-2018-20990

HIGH

tar < 0.4.16 - Arbitrary File Overwrite via Symlink or Hardlink in TAR Archive

Title source: llm
STIX 2.1

Description

An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_misc
https://rustsec.org/advisories/RUSTSEC-2018-0002.html

Scores

CVSS v3 7.5
EPSS 0.0168
EPSS Percentile 73.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-59
Status published
Products (2)
crates.io/tar 0 - 0.4.16crates.io
tar_project/tar < 0.4.16
Published Aug 26, 2019
Tracked Since Feb 18, 2026