Moderate: libtar security update
Summary
ALSA-2023:2898: Moderate: libtar security update. Affects libtar versions < 1.2.20-17.el8. Fixed in 1.2.20-17.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtar is a C library for manipulating tar archives. It supports both the strict POSIX tar format and many commonly used GNU extensions. The library is used to create, extract, and manipulate tar archives. It is widely used in various software applications and systems.
Vulnerability Detail
The libtar package is affected by multiple vulnerabilities:
-
CVE-2021-33643: This vulnerability is an out-of-bounds read in the gnu_longlink function. An attacker could exploit this issue to read arbitrary memory locations, potentially leading to information disclosure or a denial of service.
-
CVE-2021-33644: This vulnerability is an out-of-bounds read in the gnu_longname function. A remote attacker could exploit this issue to read arbitrary memory locations, potentially leading to information disclosure or a denial of service.
-
CVE-2021-33645: This vulnerability is a memory leak found in the th_read() function. An attacker could exploit this issue to cause a memory leak, potentially leading to resource exhaustion.
-
CVE-2021-33646: This vulnerability is a memory leak found in the th_read() function. An attacker could exploit this issue to cause a memory leak, potentially leading to resource exhaustion.
How To Fix
Minimum fixed version
1.2.20-17.el8
This is the first release that contains the fix.
sudo dnf update libtarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The libtar package is affected by multiple vulnerabilities that could potentially lead to information disclosure, denial of service, or resource exhaustion. It is crucial to update the libtar package to the latest version to mitigate these risks. If you need further assistance or support in addressing these vulnerabilities, please contact DevNack.com.
See every vulnerability recorded for libtar →
FAQ
libtar is a C library for manipulating tar archives. It supports both the strict POSIX tar format and many commonly used GNU extensions.
These vulnerabilities could potentially lead to information disclosure, denial of service, or resource exhaustion, depending on the specific vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
At the moment, there are no known workarounds for these vulnerabilities. It is recommended to update the libtar package to the latest version.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for libtar.
