PT-2021-22168 · Tar Crate+1 · Tar Crate+1

Martin Michaelis + 1 · Published 2021-07-19 · Updated 2021-08-25 · CVE-2021-38511

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions tar crate versions prior to 0.4.36

Description An issue was discovered in the tar crate for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal. This occurs when unpacking a tarball that contains a symlink, allowing the tar crate to create directories outside of the directory it's supposed to unpack into. The function errors when trying to create a file, but the folders are already created at this point.

Recommendations For versions prior to 0.4.36, update to version 0.4.36 to resolve the issue. As a temporary workaround, consider avoiding the use of symlinks in TAR archives until the update is applied. Restrict access to the unpack function of the Archive class to minimize the risk of exploitation. Avoid using the Builder class to create TAR archives that contain symlinks until the issue is resolved.

Exploit

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

CVE-2021-38511

GHSA-62JX-8VMH-4MCW

RUSTSEC-2021-0080

Affected Products

Debian

Tar Crate

References · 15

• 🔥 https://rustsec.org/advisories/RUSTSEC-2021-0080.html · Exploit
• 🔥 https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/tar/RUSTSEC-2021-0080.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-38511 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-38511 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-38511 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0080 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-38511 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-38511 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-38511 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-62jx-8vmh-4mcw · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-38511 · Security Note
• https://github.com/alexcrichton/tar-rs · Note
• https://github.com/alexcrichton/tar-rs/issues/238 · Note
• https://github.com/alexcrichton/tar-rs/pull/259 · Note
• https://crates.io/crates/tar · Note