CVE-2021-20193
First published: Mon Jan 18 2021(Updated: )
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU tar | <=1.33 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://savannah.gnu.org/bugs/?59897
- https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1748610
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1748610&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1917631
- https://bugzilla.redhat.com/show_bug.cgi?id=1917565
- https://security.gentoo.org/glsa/202105-29
Frequently Asked Questions
What is CVE-2021-20193?
CVE-2021-20193 is a vulnerability found in the src/list.c file of tar versions 1.33 and earlier.
What is the impact of CVE-2021-20193?
The highest threat from CVE-2021-20193 is to system availability.
How does CVE-2021-20193 affect GNU tar?
CVE-2021-20193 affects GNU tar versions 1.33 and earlier.
How can an attacker exploit CVE-2021-20193?
An attacker can exploit CVE-2021-20193 by submitting a crafted input file to tar, causing uncontrolled consumption of memory.
What is the severity of CVE-2021-20193?
CVE-2021-20193 has a severity rating of medium (5.5).
- collector/nvd-index
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/references
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-20193
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/gnu
- canonical/gnu tar
- version/gnu tar/1.33