Описание
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
Отчет
Red Hat Enterprise Linux is affected. This issue only applies when the --one-top-level option is used to extract an untrusted archive. Default tar extraction without --one-top-level is not impacted by this specific boundary failure. Users should avoid using --one-top-level as the sole confinement mechanism for untrusted archives until fixed packages are available.
Меры по смягчению последствий
Do not use --one-top-level as the sole confinement mechanism when extracting untrusted archives. Prefer extracting as an unprivileged user into a freshly created empty directory after changing into that directory (mkdir and cd), avoid extracting as root from sensitive working directories such as /, and follow the GNU tar security guidance for untrusted archives.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | tar | Affected | ||
| Red Hat Enterprise Linux 6 | tar | Out of support scope | ||
| Red Hat Enterprise Linux 7 | tar | Out of support scope | ||
| Red Hat Enterprise Linux 8 | tar | Fix deferred | ||
| Red Hat Enterprise Linux 9 | tar | Fix deferred | ||
| Red Hat Hardened Images | aardvark-dns | Not affected | ||
| Red Hat Hardened Images | chunkah | Not affected | ||
| Red Hat Hardened Images | grafana12.4 | Not affected | ||
| Red Hat Hardened Images | grafana13.1 | Not affected | ||
| Red Hat Hardened Images | netavark | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.4 Medium
CVSS3
Связанные уязвимости
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite
A flaw was found in GNU tar. When extracting an archive with the --one ...
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.
EPSS
4.4 Medium
CVSS3