Security Advisory Description
node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders. (CVE-2024-28863)
Impact
This vulnerability allows an attacker to make use of the node-tar module to consume memory on the system and potentially causing the Node.js client to stop working resulting in a denial-of-service (DoS).
Vendor | Product | Version | CPE |
---|---|---|---|
f5 | big\-ip_next | 20.0.1 | cpe:2.3:a:f5:big\-ip_next:20.0.1:*:*:*:*:*:*:* |
f5 | big\-ip_next | 20.0.2 | cpe:2.3:a:f5:big\-ip_next:20.0.2:*:*:*:*:*:*:* |
f5 | big\-ip_next | 20.1.0 | cpe:2.3:a:f5:big\-ip_next:20.1.0:*:*:*:*:*:*:* |
f5 | big\-ip_next | 20.1.1 | cpe:2.3:a:f5:big\-ip_next:20.1.1:*:*:*:*:*:*:* |
f5 | big\-ip_next | 20.2.0 | cpe:2.3:a:f5:big\-ip_next:20.2.0:*:*:*:*:*:*:* |
f5 | big\-ip_next | 1.1.0 | cpe:2.3:a:f5:big\-ip_next:1.1.0:*:*:*:*:*:*:* |
f5 | big\-ip_next | 1.1.1 | cpe:2.3:a:f5:big\-ip_next:1.1.1:*:*:*:*:*:*:* |
f5 | big\-ip_next | 1.2.0 | cpe:2.3:a:f5:big\-ip_next:1.2.0:*:*:*:*:*:*:* |
f5 | big\-ip_next | 1.2.1 | cpe:2.3:a:f5:big\-ip_next:1.2.1:*:*:*:*:*:*:* |
f5 | big\-ip_next | 1.3.0 | cpe:2.3:a:f5:big\-ip_next:1.3.0:*:*:*:*:*:*:* |