Bug 1990409 (CVE-2021-32804)
Summary: | CVE-2021-32804 nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | aileenc, alegrand, amuller, anpicker, aos-bugs, bdettelb, bmontgom, caswilli, chazlett, drieden, eparis, erooth, etamir, extras-orphan, ggaughan, gghezzo, gmalinko, gparvin, hhorak, hvyas, janstey, jburrell, jochrist, jokerman, jorton, jramanat, jwendell, jwon, kakkoyun, kaycoth, kconner, nbecker, nodejs-maint, nodejs-sig, nstielau, ocs-bugs, pkrupa, rcernich, rfreiman, spasquie, sponnaga, stcannon, tchollingsworth, thrcka, tomckay, twalsh, zsvetlik |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | nodejs-tar 3.2.2, nodejs-tar 4.4.14, nodejs-tar 5.0.6, nodejs-tar 6.1.1 | Doc Type: | If docs needed, set a value |
Doc Text: |
The npm package "tar" (aka node-tar) has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-08-26 15:35:02 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1993959, 1990410, 1991760, 1991982, 1991983, 1991984, 1991985, 1991986, 1991987, 1991988, 1991989, 1992289, 1992290, 1992291, 1992292, 1992293, 1993401, 1993939, 1993940, 1993941, 1993942, 1993943, 1994406, 1994407, 1994408, 1994409, 1994496, 1994498, 1995344, 2000548, 2004989, 2020106, 2020108, 2020109, 2020110, 2020112 | ||
Bug Blocks: | 1990418 |
Description
Dhananjay Arunesh
2021-08-05 10:57:29 UTC
Created nodejs-tar tracking bugs for this issue: Affects: fedora-all [bug 1990410] Created nodejs-tar tracking bugs for this issue: Affects: epel-7 [bug 1993959] This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:3281 https://access.redhat.com/errata/RHSA-2021:3281 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:3280 https://access.redhat.com/errata/RHSA-2021:3280 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-32804 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3623 https://access.redhat.com/errata/RHSA-2021:3623 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Extended Update Support Via RHSA-2021:3639 https://access.redhat.com/errata/RHSA-2021:3639 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2021:3638 https://access.redhat.com/errata/RHSA-2021:3638 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:3666 https://access.redhat.com/errata/RHSA-2021:3666 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 Via RHSA-2021:4618 https://access.redhat.com/errata/RHSA-2021:4618 This issue has been addressed in the following products: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8 Via RHSA-2021:5086 https://access.redhat.com/errata/RHSA-2021:5086 |