6202 matches found
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any...
GHSA-3JFQ-G458-7QM9 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any...
@camptocamp/closure-util (>=1.23.0, <=1.27.0), @cognigy/wndb-with-exceptions (>=3.0.1, <=3.0.3) +97 more potentially affected by CVE-2021-32804 via tar (>=3.0.0, <=3.1.15)
tar NPM version =3.0.0, =1.23.0, =3.0.1, =1.36.0, =0.0.1, =1.0.0, =3.0.14, =4.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.1 and more Source cves: CVE-2021-32804 Source advisory: OSV:GHSA-3JFQ-G458-7QM9...
@bloq/create-package (1.2.0), @nrwl/insights (>=0.1.0, <=8.12.4) +21 more potentially affected by CVE-2021-32804 via tar (>=5.0.2, <=5.0.5)
tar NPM version =5.0.2, =0.1.0, =8.12.4, =8.11.0-alpha.0, =0.4.0-8, =0.0.2-dependabot-npm-and-yarn-decompress-4-2-1-75c8bb4f0266fca89b3fc3fe0c4c93324e226adb, =3.0.0, =3.6.20, =2.2.0, =1.10.1, =2.3.1, =0.10.0-dev2, =7.0.0, =0.9.0, =0.9.1 and more Source cves: CVE-2021-32804 Source advisory:...
CVE-2021-32803
CVE-2021-32803 concerns the npm package tar (node-tar) with an arbitrary File Creation/Overwrite vulnerability due to insufficient symlink protection when extracting tar files. The issue arises from a directory cache and mkdir-skip logic that can be bypassed when a directory and a symlink share t...
CVE-2021-32803 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
The npm package "tar" aka node-tar before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in...
@36node/sketch-cli (>=0.1.3, <=0.3.2), @adobe/commerce-cif-commercetools-cart (>=1.0.1, <=1.0.2) +321 more potentially affected by CVE-2021-32803 via tar (>=4.0.1, <=4.4.13)
tar NPM version =4.0.1, =0.1.3, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.2.1 and more Source cves: CVE-2021-32803 Source advisory: OSV:GHSA-R628-MHMH-QJHW...
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in...
@adaptable/client (>=0.0.9, <=1.26.0), @adaptable/cloud (>=0.0.1, <=1.28.0) +359 more potentially affected by CVE-2021-32803 via tar (>=6.0.0, <=6.1.1)
tar NPM version =6.0.0, =0.0.9, =0.0.1, =1.6.0, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.1.0, =0.6.5, =1.1.0, =1.0.0, =0.0.2, =0.1.0, =0.1.8 and more Source cves: CVE-2021-32803 Source advisory: OSV:GHSA-R628-MHMH-QJHW...
@camptocamp/closure-util (>=1.23.0, <=1.27.0), @cognigy/wndb-with-exceptions (>=3.0.1, <=3.0.3) +97 more potentially affected by CVE-2021-32803 via tar (>=3.0.0, <=3.1.15)
tar NPM version =3.0.0, =1.23.0, =3.0.1, =1.36.0, =0.0.1, =1.0.0, =3.0.14, =4.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.1 and more Source cves: CVE-2021-32803 Source advisory: OSV:GHSA-R628-MHMH-QJHW...
@bloq/create-package (1.2.0), @nrwl/insights (>=0.1.0, <=8.12.4) +21 more potentially affected by CVE-2021-32803 via tar (>=5.0.2, <=5.0.5)
tar NPM version =5.0.2, =0.1.0, =8.12.4, =8.11.0-alpha.0, =0.4.0-8, =0.0.2-dependabot-npm-and-yarn-decompress-4-2-1-75c8bb4f0266fca89b3fc3fe0c4c93324e226adb, =3.0.0, =3.6.20, =2.2.0, =1.10.1, =2.3.1, =0.10.0-dev2, =7.0.0, =0.9.0, =0.9.1 and more Source cves: CVE-2021-32803 Source advisory:...
GHSA-R628-MHMH-QJHW Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in...
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
Overview The tar package has a high severity vulnerability before versions 3.2.2, 4.4.14, 5.0.6, and 6.1.1. Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths...
node-tar 后置链接漏洞
node-tar is a software package for file compression/decompression. A backlink vulnerability exists in node-tar, which is an arbitrary file creation/overwrite vulnerability that stems from insufficient symbolic link protection...
node-tar 路径遍历漏洞
node-tar is a software package for file compression/decompression. A path traversal vulnerability exists in node-tar, which is an arbitrary file creation/overwrite vulnerability that stems from insufficient absolute path cleanup...
Improper Handling of Length Parameter Inconsistency in Apache Ant
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected...
GHSA-Q5R4-CFPX-H6FH Improper Handling of Length Parameter Inconsistency in Apache Ant
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected...
GHSA-XQFJ-VM6H-2X34 Improper Handling of Length Parameter Inconsistency in Compress
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package...
Improper Handling of Length Parameter Inconsistency in Compress
When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package...
