Описание
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
A flaw was found in ISAACS's node-tar, where it is vulnerable to a denial of service, caused by the lack of folder count validation. The vulnerability exists due to the application not properly controlling the consumption of internal resources while parsing a tar file. By sending a specially crafted request, a remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Отчет
Moderate impact in Red Hat products: node-tar is vulnerable to denial of service while parsing a specially crafted tar archive because it does not validate folder depth or count. A remote attacker who can cause a product to process such an archive can exhaust memory and crash the Node.js client. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), reflecting network reachability with required user interaction and high availability impact, without confidentiality or integrity impact. The current assessment includes affected and new entries across Red Hat Satellite, Red Hat OpenShift, Red Hat Enterprise Linux nodejs components, Ansible Services, and other products; 13 product/component entries are not affected, including RHEL polkit, OpenShift networking-console-plugin, and Red Hat Discovery discovery-server-container, because those entries are outside the vulnerable node-tar parsing scope. Affected entries are delegated to product teams pursuing fixes or appropriate downstream disposition; entries explicitly marked WONTFIX or OOSS retain those recorded dispositions.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 2 | node-tar | Fix deferred | ||
| Logging Subsystem for Red Hat OpenShift | openshift-logging/kibana6-rhel8 | Not affected | ||
| Migration Toolkit for Virtualization | migration-toolkit-virtualization/mtv-console-plugin-rhel9 | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/console-mce-rhel9 | Not affected | ||
| Multicluster Engine for Kubernetes | multicluster-engine/multicluster-engine-console-mce-rhel9 | Not affected | ||
| Network Observability Operator | network-observability/network-observability-console-plugin-rhel9 | Not affected | ||
| Node HealthCheck Operator | workload-availability/node-remediation-console-rhel8 | Will not fix | ||
| OpenShift Serverless | node-tar | Will not fix | ||
| OpenShift Service Mesh 2 | openshift-service-mesh/kiali-rhel8 | Will not fix | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp-system-container | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no ...
Denial of service while parsing a tar file due to lack of folders count validation
EPSS
6.5 Medium
CVSS3