CVSS: 8.2EPSS: 0%CPEs: 7EXPL: 0CVE-2021-32803 – Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
https://notcve.org/view.php?id=CVE-2021-32803
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. • https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20 https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw https://www.npmjs.com/advisories/1771 https://www.npmjs.com/package/tar https://www.oracle.com/security-alerts/cpuoct2021.html https://access.redhat.com/security/cve/CVE-2021-32803 https://bugzilla.redhat.com/show_bug.cgi?id=1990415 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20193
https://notcve.org/view.php?id=CVE-2021-20193
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability. Se detectó un fallo en el archivo src/list.c de tar versiones 1.33 y anteriores. Este fallo permite a un atacante que puede enviar un archivo de entrada diseñado a tar causar un consumo no controlado de memoria. • https://bugzilla.redhat.com/show_bug.cgi?id=1917565 https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777 https://savannah.gnu.org/bugs/?59897 https://security.gentoo.org/glsa/202105-29 • CWE-125: Out-of-bounds Read CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2019-9923
https://notcve.org/view.php?id=CVE-2019-9923
pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers. pax_decode_header en sparse.c en GNU Tar, en versiones anteriores a la 1.32, tenía una desreferencia de puntero NULL al analizar ciertos archivos que tenían cabeceras extendidas mal formadas. • http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120 http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html http://savannah.gnu.org/bugs/?55369 https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241 https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E • CWE-476: NULL Pointer Dereference •
CVSS: 4.7EPSS: 0%CPEs: 4EXPL: 1CVE-2018-20482
https://notcve.org/view.php?id=CVE-2018-20482
GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root). GNU Tar, hasta la versión 1.30, cuando se emplea --sparse, gestiona de manera incorrecta el encogimiento de archivos durante el acceso de lectura, lo que permite que usuarios locales provoquen una denegación de servicio (bucle infinito de lectura en sparse_dump_region en sparse.c) modificando un archivo que debería ser archivado por el proceso de un usuario diferente (por ejemplo, un backup del sistema que se ejecuta como root). • http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454 http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html http://www.securityfocus.com/bid/106354 https://lists.debian.org/debian-lts-announce/2018/12/msg00023.html https://lists.debian.org/debian-lts-announce/2021/11/msg00025.html https://news.ycombinator.com/item?id=18745431 https://security.gentoo.org/glsa/201903- • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 1CVE-2016-6321 – GNU tar 1.29 Extract Pathname Bypass
https://notcve.org/view.php?id=CVE-2016-6321
Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER. Vulnerabilidad de salto de directorio en la función safer_name_suffix en GNU tar 1.14 hasta la versión 1.29 podrían permitir a atacantes remotos eludir un mecanismo de protección previsto y escribir en archivos arbitarios a través de vectores relacionados con una desinfección inadecuada del parámetro file_name, también conocida como POINTYFEATHER. The GNU tar archiver can be tricked into extracting files and directories in the given destination, regardless of the path name(s) specified on the command line. Versions 1.14 through 1.29 are affected. • http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d http://lists.gnu.org/archive/html/bug-tar/2016-10/msg00016.html http://packetstormsecurity.com/files/139370/GNU-tar-1.29-Extract-Pathname-Bypass.html http://seclists.org/fulldisclosure/2016/Oct/102 http://seclists.org/fulldisclosure/2016/Oct/96 http://www.debian.org/security/2016/dsa-3702 http://www.securityfocus.com/bid/93937 http://www.ubuntu.com/usn/USN-3132-1 https://lists.apache. • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •