PT-2021-5004 · Unknown+9 · Archive Tar+9

Drew Webber · Published 2021-07-20 · Updated 2023-02-07 · CVE-2021-32610

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Archive Tar versions prior to 1.4.14

Description The issue is related to incorrect link resolution before file access, potentially allowing an attacker to impact data integrity, availability, and confidentiality. It involves symlinks referring to targets outside of the extracted archive.

Recommendations For versions prior to 1.4.14, update to version 1.4.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the Archive Tar package until a patch is applied.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALSA-2022:7628

BDU:2021-05771

CESA-2022_7628

CVE-2021-32610

DLA-2721-1

DRUPAL-CORE-2021-004

GHSA-P8Q8-JFCV-G2H2

MGASA-2021-0393

OPENSUSE-SU-2022_3198-2

OPENSUSE-SU-2024:11168-1

OPENSUSE-SU-2024:11170-1

RHSA-2022:7628

RHSA-2022_7628

RLSA-2022:7628

SUSE-SU-2022:3198-1

SUSE-SU-2022:3198-2

SUSE-SU-2022_3198-1

USN-5027-1

USN-5027-2

Affected Products

Almalinux

Archive Tar

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 62

• https://github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755 · Patch
• https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f · Patch
• https://bdu.fstec.ru/vul/2021-05771 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:3198-2 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:7628 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/CAODVMHGL5MHQWQAQTXQ7G7OE3VQZ7LS · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0303SE17MD · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAODVMHGL5MHQWQAQTXQ7G7OE3VQZ7LS · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR · Vendor Advisory
• https://osv.dev/vulnerability/USN-5027-2 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:7628 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-7628.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-5027-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32610 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32610 · Vendor Advisory