node-tar: denial of service while parsing a tar file due to lack of folders depth validation

🗓️ 05 Nov 2024 17:49:17Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

Vulnerability in node-tar from ISAACS allows denial of service due to missing folder depth validation during tar parsing.

Reporter	Title	Published	Views	Family All 142
ibm	Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	8 Jan 202518:32	–	ibm
ibm	Security Bulletin: IBM watsonx Orchestrate Developer Edition is vulnerable to Denial of Service (DoS) due to tar	17 Dec 202510:16	–	ibm
ibm	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	4 Dec 202410:17	–	ibm
ibm	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in tar-6.2.0.tgz	7 Jul 202517:58	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in isaacs node-tar [CVE-2024-28863]	2 Apr 202517:28	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a denial of service in isaacs node-tar [CVE-2024-28863]	2 Apr 202517:30	–	ibm
ibm	Security Bulletin: IBM Software Support mobile app is vulnerable to multiple vulnerabilities due to 3rd party software	27 Feb 202519:51	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	26 Mar 202503:49	–	ibm
ibm	Security Bulletin: QRadar Pulse application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	22 Jul 202414:45	–	ibm
ibm	Security Bulletin: IBM Maximo Application Suite uses multiple packages which are vulnerable to multiple CVEs	8 Oct 202408:35	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	ansible-collection-redhat-satellite	4.2.0-1.el8sat	ansible-collection-redhat-satellite-4.2.0-1.el8sat.noarch.rpm
Red Hat Enterprise Linux	9	noarch	ansible-collection-redhat-satellite	4.2.0-1.el9sat	ansible-collection-redhat-satellite-4.2.0-1.el9sat.noarch.rpm
Red Hat Enterprise Linux	8	noarch	ansible-collection-redhat-satellite_operations	3.0.0-1.el8sat	ansible-collection-redhat-satellite_operations-3.0.0-1.el8sat.noarch.rpm
Red Hat Enterprise Linux	9	noarch	ansible-collection-redhat-satellite_operations	3.0.0-1.el9sat	ansible-collection-redhat-satellite_operations-3.0.0-1.el9sat.noarch.rpm
Red Hat Enterprise Linux	8	noarch	ansible-lint	5.4.0-1.el8pc	ansible-lint-5.4.0-1.el8pc.noarch.rpm
Red Hat Enterprise Linux	9	noarch	ansible-runner	2.2.1-5.el9pc	ansible-runner-2.2.1-5.el9pc.noarch.rpm
Red Hat Enterprise Linux	8	noarch	ansible-runner	2.2.1-6.el8sat	ansible-runner-2.2.1-6.el8sat.noarch.rpm
Red Hat Enterprise Linux	8	noarch	ansiblerole-foreman_scap_client	0.3.0-1.el8sat	ansiblerole-foreman_scap_client-0.3.0-1.el8sat.noarch.rpm
Red Hat Enterprise Linux	9	noarch	ansiblerole-foreman_scap_client	0.3.0-1.el9sat	ansiblerole-foreman_scap_client-0.3.0-1.el9sat.noarch.rpm
Red Hat Enterprise Linux	8	noarch	ansiblerole-insights-client	1.7.1-2.el8sat	ansiblerole-insights-client-1.7.1-2.el8sat.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2024-28863
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-28863
security	www.security.netapp.com/advisory/ntap-20240524-0005/
cve	www.cve.org/CVERecord

03 Jul 2026 17:57Current

7.4High risk

Vulners AI Score7.4

CVSS 3.16.5

EPSS0.00929

SSVC

node-tar isaacs tar parsing folder depth validation denial of service resource exhaustion