@adaptable/client (>=0.0.9, <=1.26.0), @adaptable/cloud (>=0.0.1, <=1.28.0) +446 more potentially affected by CVE-2021-37712 via tar (>=6.0.0, <=6.1.8)

tar NPM version =6.0.0, =0.0.9, =0.0.1, =1.6.0, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.1.0, =0.6.5, =1.1.0, =1.0.0, =0.0.2, =1.1.4-alpha.1, =1.1.4-alpha.2 and more Source cves: CVE-2021-37712 Source advisory: OSV:GHSA-QQ89-HQ3F-393P...

@bloq/create-package (1.2.0), @nrwl/insights (>=0.1.0, <=8.12.4) +21 more potentially affected by CVE-2021-37712 via tar (>=5.0.2, <=5.0.7)

tar NPM version =5.0.2, =0.1.0, =8.12.4, =8.11.0-alpha.0, =0.4.0-8, =0.0.2-dependabot-npm-and-yarn-decompress-4-2-1-75c8bb4f0266fca89b3fc3fe0c4c93324e226adb, =3.0.0, =3.6.20, =2.2.0, =1.10.1, =2.3.1, =0.10.0-dev2, =7.0.0, =0.9.0, =0.9.1 and more Source cves: CVE-2021-37712 Source advisory:...

Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in...

37fis (>=1.0.0, <=1.0.2), 88slot-ap (1.0.0) +950 more potentially affected by CVE-2021-37712 via tar (>=3.0.0, <=4.4.15)

tar NPM version =3.0.0, =1.0.0, =0.1.3, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.1.0 - @adobe/commerce-cif-magento-graphql 1.0.0 and more Source cves: CVE-2021-37712 Source advisory: OSV:GHSA-QQ89-HQ3F-393P...

GHSA-QQ89-HQ3F-393P Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in...

@adaptable/client (>=0.0.9, <=1.26.0), @adaptable/cloud (>=0.0.1, <=1.28.0) +446 more potentially affected by CVE-2021-37713 via tar (>=6.0.0, <=6.1.8)

tar NPM version =6.0.0, =0.0.9, =0.0.1, =1.6.0, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.4.0-next.7, =0.1.0, =0.6.5, =1.1.0, =1.0.0, =0.0.2, =1.1.4-alpha.1, =1.1.4-alpha.2 and more Source cves: CVE-2021-37713 Source advisory: OSV:GHSA-5955-9WPR-37JH...

@bloq/create-package (1.2.0), @nrwl/insights (>=0.1.0, <=8.12.4) +21 more potentially affected by CVE-2021-37713 via tar (>=5.0.2, <=5.0.7)

tar NPM version =5.0.2, =0.1.0, =8.12.4, =8.11.0-alpha.0, =0.4.0-8, =0.0.2-dependabot-npm-and-yarn-decompress-4-2-1-75c8bb4f0266fca89b3fc3fe0c4c93324e226adb, =3.0.0, =3.6.20, =2.2.0, =1.10.1, =2.3.1, =0.10.0-dev2, =7.0.0, =0.9.0, =0.9.1 and more Source cves: CVE-2021-37713 Source advisory:...

@36node/sketch-cli (>=0.1.3, <=0.3.2), @adobe/commerce-cif-commercetools-cart (>=1.0.1, <=1.0.2) +324 more potentially affected by CVE-2021-37713 via tar (>=4.0.1, <=4.4.15)

tar NPM version =4.0.1, =0.1.3, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.1, =1.2.1 and more Source cves: CVE-2021-37713 Source advisory: OSV:GHSA-5955-9WPR-37JH...

Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archiv...

GHSA-5955-9WPR-37JH Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization

Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archiv...

Exploit for Path Traversal in Tar_Project Tar

CVE-2021-32804 yamory blog 「CVE-2021-32804 npmにも影響があるnode-ta...

node-tar 路径遍历漏洞

node-tar is a package for file compression/decompression. A path traversal vulnerability exists in node-tar, which stems from an arbitrary file creation override and arbitrary code execution vulnerability in the npm package "tar" aka node-tar before 4.4.18, 5.0.10, and 6.1.9. An attacker could us...

CVE-2021-37712

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...

CVE-2021-37712 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...

CVE-2021-37712

The npm package "tar" aka node-tar before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achiev...

CVE-2021-37701 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links

The npm package "tar" aka node-tar before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieve...

node-tar 后置链接漏洞

node-tar is a software package for file compression/decompression. A backlink vulnerability exists in Node-tar, which stems from the product not validating special characters. An attacker can use this vulnerability to create malicious files in other paths...

PT-2021-7037 · Npm +6 · Node-Tar +6

Name of the Vulnerable Software and Affected Versions: node-tar versions prior to 4.4.18 node-tar versions prior to 5.0.10 node-tar versions prior to 6.1.9 Description: The issue is related to the handling of tar archives by the node-tar module, which can lead to arbitrary file creation, overwrit...

August 31 2021 Security Releases

August 31 2021 Security Releases Update 6-Dec-2021 Security releases available Updates are now available for v14.x, and v12.x Node.js release lines for the following issues. npm 6 update - node-tar There are vulnerabilities in the node-tar which are related to the initial reports and subsequent...

CVE-2021-37712

CVE-2021-37712 affects the npm package node-tar (tar). The issue arises from insufficient symlink protection during extraction: a directory cache could be poisoned by a misrepresented path when a tar contains a directory and a symlink whose names Unicode-normalize to the same value, bypassing che...