CVE-2021-32804

{"id": "CVE-2021-32804", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.8}]}, "published": "2021-08-03T19:15:08.410", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9", "tags": ["Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.npmjs.com/advisories/1770", "tags": ["Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.npmjs.com/package/tar", "tags": ["Product", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The npm package \"tar\" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar."}, {"lang": "es", "value": "El paquete npm \"tar\" (tambi\u00e9n se conoce como node-tar) versiones anteriores a 6.1.1, 5.0.6, 4.4.14 y 3.3.2, presenta una vulnerabilidad de Creaci\u00f3n y Sobrescritura de archivos arbitraria debido a un saneo insuficiente de rutas absolutas. node-tar pretende impedir la extracci\u00f3n de rutas absolutas de archivos al convertir las rutas absolutas en relativas cuando el flag \"preservePaths\" no est\u00e1 establecido en \"true\". Esto se consigue eliminando el root de la ruta absoluta de cualquier ruta de archivo absoluta contenida en un archivo tar. Por ejemplo, \"home/user/.bashrc\" se convertir\u00eda en \"home/user/.bashrc\". Esta l\u00f3gica era insuficiente cuando las rutas de los archivos conten\u00edan roots de ruta repetidas, como \"////home/user/.bashrc\". \"node-tar\" s\u00f3lo eliminaba un \u00fanico root de esas rutas. Cuando se daba una ruta de archivo absoluta con ra\u00edces de ruta repetidas, la ruta resultante (por ejemplo, \"///home/user/.bashrc\") segu\u00eda resolvi\u00e9ndose como una ruta absoluta, permitiendo as\u00ed la creaci\u00f3n y sobrescritura de archivos arbitraria. Este problema se ha solucionado en las versiones 3.2.2, 4.4.14, 5.0.6 y 6.1.1. Los usuarios pueden solucionar esta vulnerabilidad sin necesidad de actualizar al crear un m\u00e9todo personalizado \"onentry\" que sanee \"entry.path\" o un m\u00e9todo \"filter\" que elimine las entradas con rutas absolutas. Consulte el aviso de GitHub mencionado para obtener m\u00e1s detalles. Tenga en cuenta CVE-2021-32803 que corrige un error similar en versiones posteriores de tar"}], "lastModified": "2022-04-25T19:12:42.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tar_project:tar:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "48083832-29DB-4428-836C-BC1072AC6384", "versionEndExcluding": "3.2.2"}, {"criteria": "cpe:2.3:a:tar_project:tar:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "77DE1692-7EF1-43FF-95CB-B1EAA8CB030B", "versionEndExcluding": "4.4.14", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:tar_project:tar:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "EF8B9011-1EAA-4D9E-89CA-597D7309EE66", "versionEndExcluding": "5.0.6", "versionStartIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:tar_project:tar:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "24EC2FC6-7549-4C94-9560-54A88703BCA5", "versionEndExcluding": "6.1.1", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "53B2BB06-A2F7-4603-89C3-C8500E55483A"}, {"criteria": "cpe:2.3:a:oracle:graalvm:21.2.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "01E88C86-8C04-4A4A-BF45-9082AA783056"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B0F46497-4AB0-49A7-9453-CC26837BF253", "versionEndExcluding": "1.0.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}