Lucene search

[email protected]CVE-2021-33644

HistoryAug 10, 2022 - 8:15 p.m.

CVE-2021-33644

2022-08-1020:15:20

CWE-125

[email protected]

web.nvd.nist.gov

cve-2021-33644

attacker

crafted tar file

out-of-bounds read

nvd

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

8.2 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

Affected configurations

NVD

Node

feeplibtarRange<1.2.21

Node

huaweiopeneulerMatch20.03sp1lts

huaweiopeneulerMatch20.03sp3lts

huaweiopeneulerMatch22.03lts

Node

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

CPENameOperatorVersion
feep:libtarfeep libtarlt1.2.21

CPE	Name	Operator	Version
feep:libtar	feep libtar	lt	1.2.21

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "libtar",
    "versions": [
      {
        "version": "<1.2.21",
        "status": "affected"
      }
    ]
  }
]