Ubuntu.comUB:CVE-2019-13173CVE-2019-13173
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
62.2%
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting
tarballs containing a hardlink to a file that already exists in the system,
and a file that matches the hardlink, will overwrite the system’s file with
the contents of the extracted file. The fstream.DirWriter() function is
vulnerable.
Notes
| Author | Note |
|---|---|
| ebarretto | According to a Github comment, the fix might not be enough. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | node-fstream | < 1.0.10-1ubuntu0.18.04.1 | UNKNOWN |
| ubuntu | 19.04 | noarch | node-fstream | < 1.0.10-1ubuntu0.19.04.2 | UNKNOWN |
| ubuntu | 19.10 | noarch | node-fstream | < 1.0.12-1 | UNKNOWN |
| ubuntu | 20.04 | noarch | node-fstream | < 1.0.12-1 | UNKNOWN |
| ubuntu | 20.10 | noarch | node-fstream | < 1.0.12-1 | UNKNOWN |
| ubuntu | 21.04 | noarch | node-fstream | < 1.0.12-1 | UNKNOWN |
| ubuntu | 21.10 | noarch | node-fstream | < 1.0.12-1 | UNKNOWN |
| ubuntu | 22.04 | noarch | node-fstream | < 1.0.12-1 | UNKNOWN |
| ubuntu | 14.04 | noarch | node-fstream | < 0.1.24-1ubuntu0.14.04.1~esm1 | UNKNOWN |
| ubuntu | 16.04 | noarch | node-fstream | < 0.1.24-1ubuntu0.16.04.1~esm1 | UNKNOWN |
References
github.com/npm/fstream/commit/6a77d2fa6e1462693cf8e46f930da96ec1b0bb22
launchpad.net/bugs/cve/CVE-2019-13173
nvd.nist.gov/vuln/detail/CVE-2019-13173
security-tracker.debian.org/tracker/CVE-2019-13173
ubuntu.com/security/notices/USN-4123-1
www.cve.org/CVERecord?id=CVE-2019-13173
www.npmjs.com/advisories/886
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
62.2%