python: infinite loop in the tarfile module via crafted TAR archive

A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...

USN-4777-1: node-tar vulnerability

It was discovered that node-tar mishandled certain tar archives. An attacker could use this vulnerability to write arbitrary files to the filesystem...

USN-4777-1 node-tar vulnerability

It was discovered that node-tar mishandled certain tar archives. An attacker could use this vulnerability to write arbitrary files to the filesystem...

Ubuntu: Security Advisory (USN-4754-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-4754-3: Python vulnerabilities

USN-4754-1 fixed vulnerabilities in Python. This update provides the corresponding updates for Ubuntu 18.04 and Ubuntu 20.04. In the case of Python 2.7 for 20.04, these additional fixes are included: It was dicovered that Python allowed remote attackers to cause a denial of service resource...

USN-4754-3 python2.7, python3.7, python3.8 vulnerabilities

USN-4754-1 fixed vulnerabilities in Python. This update provides the corresponding updates for Ubuntu 18.04 and Ubuntu 20.04. In the case of Python 2.7 for 20.04, these additional fixes are included: It was dicovered that Python allowed remote attackers to cause a denial of service resource...

Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2021-1623)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.9.1 : python3 (EulerOS-SA-2021-1623)

According to the versions of the python3 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - In Python 3 through 3.9.0, the Lib/test/multibytecodecsupport.py CJK codec tests call eval on content retrieved via...

NewStart CGSL CORE 5.04 / MAIN 5.04 : cpio Vulnerability (NS-SA-2021-0043)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has cpio packages installed that are affected by a vulnerability: - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an...

NewStart CGSL MAIN 6.02 : file-roller Multiple Vulnerabilities (NS-SA-2021-0068)

The remote NewStart CGSL host, running version MAIN 6.02, has file-roller packages installed that are affected by multiple vulnerabilities: - An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly...

NewStart CGSL MAIN 6.02 : python3 Multiple Vulnerabilities (NS-SA-2021-0059)

The remote NewStart CGSL host, running version MAIN 6.02, has python3 packages installed that are affected by multiple vulnerabilities: - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to...

python: infinite loop in the tarfile module via crafted TAR archive

A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation...

RHEL 7 : python (RHSA-2021:0761)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0761 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic dat...

Why WAFs can’t catch VMware CVE-2021-21972 Remote Code Execution Exploit?

The recent critical security issue in VMware vCenter was discovered this January and fixed on February 23rd . The exploit looks like a simple JSP shell upload, but for some reason, its a blind spot for Web Application Firewalls WAFs. Lets understand why. The CVE-2021-21972 affects vCenter version...

EulerOS Virtualization 3.0.6.6 : libtar (EulerOS-SA-2021-1491)

According to the version of the libtar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow...

Arbitrary File Rewrite

spring-integration-zip is vulnerable to an arbitrary file rewrite aka a zip slip vulnerability. An incomplete fix of CVE-2018-1263 allows an attacker to send a malicious zip archive bzip2, tar, xz, war, cpio, 7z with path traversal filenames, leading to writing of files outside of the target...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

Path traversal

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

[ASA-202102-41] tar: denial of service

Arch Linux Security Advisory ASA-202102-41 ========================================== Severity: Low Date : 2021-02-27 CVE-ID : CVE-2021-20193 Package : tar Type : denial of service Remote : No Link : https://security.archlinux.org/AVG-1462 Summary ======= The package tar before version 1.34-1 is...