Heap Overflow Vulnerability in apk-tools
Summary
CVE-2017-9671: A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block. Affects apk-tools versions < 2.7.2-r0. Fixed in 2.7.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
apk-tools is a package manager used in Alpine Linux. It is responsible for managing the installation, upgrade, and removal of software packages on the Alpine Linux operating system. This vulnerability affects versions 3.10, 3.11, 3.12, and 3.13 of apk-tools.
Vulnerability Detail
The vulnerability, identified as CVE-2017-9671, is a heap overflow in apk-tools. It can be exploited by a remote attacker by crafting a malicious APKINDEX.tar.gz file with a bad pax header block. This can lead to a denial of service or allow the attacker to execute arbitrary code on the affected system.
How To Fix
Minimum fixed version
2.7.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade apk-toolsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update apk-tools to the fixed version.
Conclusion
The heap overflow vulnerability in apk-tools can be exploited by a remote attacker to cause a denial of service or execute arbitrary code. It is crucial to update apk-tools to version 2.7.2-r0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apk-tools →
FAQ
apk-tools is a package manager used in Alpine Linux to manage software packages.
This vulnerability can result in a denial of service or allow an attacker to execute arbitrary code on the affected system.
To fix this vulnerability, update apk-tools to version 2.7.2-r0 or later.
No, there is no known workaround. Updating apk-tools is the recommended solution.
You can find more information about this vulnerability in the CVE-2017-9671 JSON report: [link to the report]
References
Related vulnerabilities
Recent vulnerabilities recorded for apk-tools.
