CVE-2021-32803
1 advisory.
npm/tar CVE-2021-32803: high 8.2, EPSS 7.80%
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
Action: Upgrade tar to 3.2.3 or later.
npm i tar@3.2.3npm i tar@4.4.15npm i tar@5.0.7npm i tar@6.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.2.3 | - |
| 4.0.0 | 4.4.15 | - |
| 5.0.0 | 5.0.7 | - |
| 6.0.0 | 6.1.2 | - |
Fixed versions
| 3.2.3 | 4.4.15 | 5.0.7 | 6.1.2 |
Sources
- osv: GHSA-r628-mhmh-qjhw
- https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw
- https://nvd.nist.gov/vuln/detail/CVE-2021-32803
- https://github.com/isaacs/node-tar/commit/46fe35083e2676e31c4e0a81639dce6da7aaa356
- https://github.com/isaacs/node-tar/commit/5987d9a41f6bfbf1ddab1098e1fdcf1a5618f571
- https://github.com/isaacs/node-tar/commit/85d3a942b4064e4ff171f91696fced7975167349
- https://github.com/isaacs/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20
- https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://github.com/isaacs/node-tar
- https://www.npmjs.com/advisories/1771
- https://www.npmjs.com/package/tar
- https://www.oracle.com/security-alerts/cpuoct2021.html
CVE-2021-32803 · published · modified · JSON