CVE-2024-12905: Path Traversal
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/tar-fsto a version that resolves this vulnerability.Fixed in 3.0.7 - Upgrade
Upgrade
npm/tar-fsto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
npm/tar-fsto a version that resolves this vulnerability.Fixed in 1.16.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.1.1-18 - Upgrade
Upgrade
debian/node-tar-fsto a version that resolves this vulnerability.Fixed in 2.1.3-0+deb12u1 - Upgrade
Upgrade
debian/node-tar-fsto a version that resolves this vulnerability.Fixed in 3.0.8+~cs2.0.4-1 - Upgrade
Upgrade
debian/node-tar-fsto a version that resolves this vulnerability.Fixed in 2.1.3-0+deb12u2Fixed in 3.0.9+~cs2.0.4-1+deb13u1Fixed in 3.1.2+~cs2.0.4-1 - Upgrade
Upgrade
tar-fsto a version that resolves this vulnerability.Fixed in 1.16.4 - Upgrade
Upgrade
tar-fsto a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
tar-fsto a version that resolves this vulnerability.Fixed in 3.0.7 - Upgrade
Upgrade
tar-fsto a version that resolves this vulnerability.Fixed in 3.0.8
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12905?
CVE-2024-12905 has been classified with a severity rating that indicates it poses a significant risk of unauthorized file access or system compromise.
How do I fix CVE-2024-12905?
To fix CVE-2024-12905, upgrade to a version of tar-fs that is not vulnerable, ensuring you are using at least version 1.16.4 or 2.1.3 and above.
What systems are affected by CVE-2024-12905?
CVE-2024-12905 affects tar-fs versions from 0.0.0 up to but not including 1.16.4, and versions from 2.0.0 up to but not including 2.1.3, and 3.0.0 up to but not including 3.0.9.
What can happen if CVE-2024-12905 is exploited?
Exploitation of CVE-2024-12905 can lead to unauthorized file writes or overwrites, potentially affecting the security of the filesystem.
Is CVE-2024-12905 related to path traversal vulnerabilities?
Yes, CVE-2024-12905 is related to both improper link resolution before file access and improper limitation of a pathname to a restricted directory, which may allow path traversal.