Описание
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.
_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.
A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.
A flaw was found in the perl-Archive-Tar component. An attacker can exploit this vulnerability by providing a crafted tar header with an excessively large entry size field. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
Отчет
This Important flaw in perl-Archive-Tar allows a Denial of Service via memory exhaustion when processing specially crafted tar archives. The Archive::Tar module's _read_tar() method reads entry payload sizes from the tar header without enforcing an upper bound, allowing an attacker to craft a tar archive whose header declares a multi-gigabyte entry size, causing immediate large memory allocation. Applications or scripts that process untrusted tar files using Archive::Tar are vulnerable to resource exhaustion.
Меры по смягчению последствий
To mitigate this issue, avoid processing untrusted tar archives with applications using Perl's Archive::Tar module. If untrusted tar processing is required, consider imposing resource limits (e.g., ulimit) on the processes handling tar files to contain memory exhaustion and prevent wider system impact.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | perl-Archive-Tar | Affected | ||
| Red Hat Enterprise Linux 7 | perl-Archive-Tar | Affected | ||
| Red Hat Enterprise Linux 8 | perl:5.32/perl-Archive-Tar | Affected | ||
| Red Hat Enterprise Linux 8 | perl-Archive-Tar | Affected | ||
| Red Hat Enterprise Linux 9 | perl-Archive-Tar | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via ...
Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.
EPSS
7.5 High
CVSS3