REDHAT-BUG-2407258: Medium severity go archive/tar vulnerability
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2407258?
The severity of REDHAT-BUG-2407258 is classified as high due to potential memory exhaustion from unbounded data reading.
How do I fix REDHAT-BUG-2407258?
To fix REDHAT-BUG-2407258, update the GNU tar package to the latest version provided by Red Hat.
What are the potential impacts of REDHAT-BUG-2407258?
The potential impacts of REDHAT-BUG-2407258 include excessive memory usage leading to denial of service.
Is REDHAT-BUG-2407258 present in all versions of GNU tar?
REDHAT-BUG-2407258 affects specific versions of GNU tar, particularly those that do not implement a maximum size for sparse region data blocks.
Can REDHAT-BUG-2407258 be exploited remotely?
Yes, REDHAT-BUG-2407258 can be exploited remotely if a malicious archive is processed by the vulnerable tar Reader.