CVE-2019-13173

Name of the Vulnerable Software and Affected Versions fstream versions prior to 1.0.12

Description The issue exists due to insufficient input validation in the fstream.DirWriter() function. This can be exploited by a remote attacker to overwrite files in the system. Specifically, extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file.

Recommendations For versions prior to 1.0.12, upgrade to version 1.0.12 or later. As a temporary workaround, consider disabling the fstream.DirWriter() function until a patch is available. Restrict access to the fstream package to minimize the risk of exploitation. Avoid using the fstream.DirWriter() function in the affected API endpoints until the issue is resolved.