Critical Security Update for tar Package: Red Hat Security Advisory RHSA-2023:0959
Summary
RHSA-2023:0959: Red Hat Security Advisory: tar security update. Affects tar versions < 2:1.34-6.el9_1. Fixed in 2:1.34-6.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'tar' package is a widely used utility in Unix and Linux systems for archiving files. It allows users to create, maintain, modify, and extract files from archives, commonly in .tar format. This package is essential for system backups and software distribution. However, vulnerabilities in 'tar' can lead to severe security risks, including unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability identified in the 'tar' package is a security flaw that can be exploited by attackers to execute arbitrary code or cause a denial of service. This issue arises from improper handling of certain input files, which can lead to unexpected behavior during the extraction process. The potential ramifications include data loss, system compromise, and unauthorized access to sensitive information. The vulnerability has a CVSS score of 5.5, indicating a moderate level of risk.
How To Fix
Minimum fixed version
2:1.34-6.el9_1
This is the first release that contains the fix.
sudo dnf update tarTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'tar' command with untrusted or unknown archives until the package is updated. Additionally, consider using alternative archiving tools that do not exhibit this vulnerability.
Conclusion
The tar package is critical for file archiving in Unix and Linux systems, but a recently discovered vulnerability poses a moderate risk. Users are advised to update to the latest patched version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tar →
FAQ
The vulnerability allows for potential arbitrary code execution or denial of service due to improper input handling.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
As a temporary measure, avoid using the 'tar' command with untrusted archives and consider alternative tools.
Yes, the vulnerability has a CVSS score of 5.5, indicating a moderate risk level.
Detailed information can be found in the Red Hat Security Advisory RHSA-2023:0959.
Related vulnerabilities
Recent vulnerabilities recorded for tar.
