Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

🗓️ 31 Aug 2021 16:05:17Reported by GitHub Advisory DatabaseType

Arbitrary File Overwrite via symlink protection bypass using unicode-normalized directory cache poisonin

Reporter	Title	Published	Views	Family All 185
IBM Security Bulletins	Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	24 May 202218:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	23 Nov 202115:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js affect IBM Integration Bus v10 (CVE-2021-37712)	2 Dec 202118:13	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-37712)	22 Apr 202219:45	–	ibm
IBM Security Bulletins	Security Bulletin: Open Source Dependency Vulnerability	15 May 202318:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	30 Mar 202316:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Machine Learning Accelerator on Cloud Pak for Data is vulnerable to multiple vulnerabilities	12 Dec 202317:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities fixed in IBM Security Verify Governance - Identity Manager Virtual Appliance	30 Jun 202305:54	–	ibm
IBM Security Bulletins	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	18 Oct 202213:51	–	ibm

Vulners

Node

tar_project tarRange3.0.0–4.4.18npm

tar_project tarRange6.0.0–6.1.9npm

tar_project tarRange5.0.0–5.0.10npm

Source	Link
github	www.github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p
npmjs	www.npmjs.com/package/tar
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-37712
oracle	www.oracle.com/security-alerts/cpuoct2021.html
debian	www.debian.org/security/2021/dsa-5008
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
lists	www.lists.debian.org/debian-lts-announce/2022/12/msg00023.html
github	www.github.com/isaacs/node-tar/commit/1739408d3122af897caefd09662bce2ea477533b
github	www.github.com/isaacs/node-tar/commit/b6162c7fafe797f856564ef37f4b82747f051455
github	www.github.com/isaacs/node-tar/commit/bb93ba243746f705092905da1955ac3b0509ba1e

07 Feb 2024 18:41Current

7.1High risk

Vulners AI Score7.1

CVSS 24.4

CVSS 3.18.2 - 8.6

EPSS0.00085