Bug 2547431

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in openshift/source-to-image's paranoid tar extraction mode (NewParanoid). The extractLink() function in pkg/tar/tar.go validates that a symlink target stays inside the extraction directory by computing a sanitized path using filepath.Clean(filepath.Join(dest, "..", source)), but then creates the actual symlink using the raw, unvalidated header.Linkname via os.Symlink(source, dest). For relative symlink traversals this check works correctly because filepath.Join resolves ".." components. However, for absolute Linkname values (e.g. "/etc/passwd"), Go's filepath.Join does not re-root, so the sanitized path folds harmlessly under the jail directory and passes the check, while the actual symlink points to the attacker-specified absolute host path. This bypasses the security boundary introduced to fix CVE-2018-1103. The paranoid mode is used by s2i's primary build strategy, including paths that extract tar streams produced by attacker-controlled builder image scripts (save-artifacts, assemble). A malicious builder image can plant symlinks pointing to arbitrary absolute host paths outside the sandbox directory.