PT-2021-2811 · Gnu+6 · Tar+6

Carlos Andres Ramirez · Published 2021-01-17 · Updated 2025-08-28 · CVE-2021-20193

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions tar versions 1.33 and earlier

Description A flaw in the src/list.c of tar allows an attacker who can submit a crafted input file to cause uncontrolled consumption of memory, potentially leading to system availability issues. The vulnerability is related to a buffer overflow in the read header() function of GNU Tar. An attacker can exploit this vulnerability by submitting a specially crafted input file, which may result in a denial of service.

Recommendations For tar versions 1.33 and earlier, consider updating to a newer version to mitigate the risk of exploitation. As a temporary workaround, restrict the use of tar with untrusted input files to minimize the risk of memory consumption issues. Avoid using tar with crafted input files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Out of bounds Read

Weakness Enumeration

CWE-401

CWE-125

Related Identifiers

ALT-PU-2021-1651

BDU:2021-02357

CVE-2021-20193

MGASA-2021-0233

OESA-2021-1173

OPENSUSE-SU-2021:0494-1

OPENSUSE-SU-2021_0494-1

OPENSUSE-SU-2022_1548-1

OPENSUSE-SU-2024:11620-1

SUSE-SU-2021:0974-1

SUSE-SU-2021:0975-1

SUSE-SU-2021_0974-1

SUSE-SU-2021_0975-1

SUSE-SU-2022:1548-1

SUSE-SU-2022_1548-1

USN-5329-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Suse

Ubuntu

Tar

References · 43

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20193 · Vendor Advisory
• https://savannah.gnu.org/bugs/?59897 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5329-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20193 · Security Note
• https://advisories.mageia.org/MGASA-2021-0233.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0494-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20193 · Security Note
• https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:11620-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1173 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20193 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1917565 · Patch
• https://ubuntu.com/security/notices/USN-5329-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0975-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-20193 · Vendor Advisory