Bug 2033394 (CVE-2021-37713)

Summary:	CVE-2021-37713 nodejs-tar: Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
Product:	[Other] Security Response	Reporter:	ayambast
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	amuller, anpicker, aos-bugs, bmontgom, eparis, erooth, jburrell, jokerman, nstielau, spasquie, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-tar 4.4.18, nodejs-tar 5.0.10, nodejs-tar 6.1.9	Doc Type:	---
Doc Text:	A flaw was found in the npm package "tar" (aka node-tar). On Windows systems, when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory rather than the extraction target directory.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-12-16 17:26:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1999747

Description ayambast 2021-12-16 16:43:25 UTC

On Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory.

Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path.

This only affects users of node-tar on *Windows* systems.

Reference: 
https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh

Comment 1 Product Security DevOps Team 2021-12-16 17:26:00 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-37713