Lucene search
Veracode Vulnerability DatabaseVERACODE:31892HistorySep 01, 2021 - 4:26 a.m.
Remote Code Execution (RCE)
2021-09-0104:26:51
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
17
0.001 Low
EPSS
Percentile
48.3%
tar is vulnerable to Remote Code Execution (RCE). An attacker is able to exploit the vulnerability by modifying the symbolic link. The vulnerability exists due to the lack of sanitization of the symbolic link thus allowing the system to extract file through a maliciously modified symbolic link.
| CPE | Name | Operator | Version |
|---|---|---|---|
| tar | le | 6.1.8 | |
| tar | le | 5.0.9 | |
| tar | le | 4.4.17 | |
| tar | le | 4.4.13 | |
| tar | le | 6.1.0 | |
| nodejs:3.11 | eq | 12.21.0-r0 | |
| nodejs:3.11 | eq | 12.22.1-r0 | |
| nodejs:3.11 | eq | 12.15.0-r1 | |
| nodejs:3.11 | eq | 12.22.2-r0 | |
| nodejs:3.11 | eq | 12.22.4-r0 |
Related
nodejs
nodejs
ubuntucve
ubuntucve
CVE-2021-37712
2021-08-31 00:00:00
debiancve
debiancve
CVE-2021-37712
2021-08-31 17:15:08
ibm
ibm
Security Bulletin: A security vulnerability in Node.js tar module affects IBM Cloud Pak for Multicloud Management Managed Services
2021-11-09 18:11:48
alpinelinux
alpinelinux
CVE-2021-37712
2021-08-31 17:15:08
prion
prion
Remote code execution
2021-08-31 17:15:00
github
github
cvelist
cvelist
cve
cve
CVE-2021-37712
2021-08-31 17:15:08
osv
osv
CVE-2021-37712
2021-08-31 17:15:08
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
2021-08-31 16:05:17
node-tar - security update
2021-11-11 00:00:00
redhatcve
redhatcve
CVE-2021-37712
2021-08-31 17:10:03
nvd
nvd
CVE-2021-37712
2021-08-31 17:15:08
nessus
nessus
Debian DSA-5008-1 : node-tar - security update
2021-11-12 00:00:00
Debian DLA-3237-1 : node-tar - LTS security update
2022-12-12 00:00:00
Node.js Multiple Vulnerabilities (August 31st 2021 Security Releases)
2021-10-19 00:00:00
openvas
openvas
Debian: Security Advisory (DSA-5008-1)
2021-11-14 00:00:00
Debian: Security Advisory (DLA-3237-1)
2022-12-13 00:00:00
Mageia: Security Advisory (MGASA-2022-0103)
2022-03-22 00:00:00
debian
debian
[SECURITY] [DSA 5008-1] node-tar security update
2021-11-11 21:57:59
[SECURITY] [DLA 3237-1] node-tar security update
2022-12-12 14:15:54
mageia
mageia
Updated nodejs-tar packages fix security vulnerability
2022-03-21 23:18:30
Updated nodejs packages fix security vulnerability
2021-10-06 22:41:56
redhat
redhat
freebsd
freebsd
Node.js -- August 2021 Security Releases (2)
2021-08-31 00:00:00
suse
suse
Security update for nodejs14 (important)
2021-12-10 00:00:00
Security update for nodejs12 (important)
2021-12-06 00:00:00
Security update for nodejs14 (important)
2021-12-07 00:00:00
nodejsblog
nodejsblog
August 31 2021 Security Releases
2021-08-31 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 10 package node version 14.17.6-alt1
2021-09-01 00:00:00
almalinux
almalinux
Moderate: nodejs:14 security, bug fix, and enhancement update
2022-02-01 20:08:39
rocky
rocky
12 bug fix and enhancement update
2022-06-21 11:47:44
nodejs:14 security, bug fix, and enhancement update
2022-02-01 20:08:39
oraclelinux
oraclelinux
nodejs:14 security, bug fix, and enhancement update
2022-02-02 00:00:00
gentoo
gentoo
Node.js: Multiple Vulnerabilities
2024-05-08 00:00:00
ics
ics
Siemens SINEC INS
2022-03-10 12:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2021
2021-10-19 00:00:00