Security Bulletin: A vulnerability in GNU Tar may affect IBM Robotic Process Automation for Cloud Pak and result in a buffer overflow (CVE-2022-48303)

Summary

Gnu Tar is use by IBM Robotic Process Automation for Cloud Pak as part of base container images for OCR and Anitvirus.

Vulnerability Details

CVEID:CVE-2022-48303
**DESCRIPTION:**GNU Tar is vulnerable to a heap-based buffer overflow, caused by an out-of-bounds read in the from_header() function in list.c when processing of V7 archive files. By persuading a victim to open a specially-crafted V7 file using whitespace characters in the mtime parameter, a remote attacker could overflow a buffer and execute arbitrary code in the context of the current process.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/245770 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Workarounds and Mitigations

None