REDHAT-BUG-2481314: High severity Perl Archive::Tar vulnerability
Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.
makespecialfile() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.
A subsequent open through the extracted name reads or writes the attacker chosen path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl Archive::Tarto a version that resolves this vulnerability.Fixed in 3.08 - Compensating control
When extracting with Perl Archive::Tar, ensure you do not extract symlinks (linkname targets) that resolve outside the intended extraction directory; reject or sanitize symlink targets so they cannot point to paths outside the extraction directory, including absolute paths and paths containing ..
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2481314?
The severity of REDHAT-BUG-2481314 is rated as high, with a score of 7.
What is the vulnerability in REDHAT-BUG-2481314?
REDHAT-BUG-2481314 allows Archive::Tar versions before 3.08 to extract symlinks with attacker controlled targets outside the extraction directory.
How do I fix REDHAT-BUG-2481314?
To fix REDHAT-BUG-2481314, upgrade to Archive::Tar version 3.08 or later.
What software is affected by REDHAT-BUG-2481314?
The affected software for REDHAT-BUG-2481314 is Perl Archive::Tar versions earlier than 3.08.
What is the risk associated with REDHAT-BUG-2481314?
The risk associated with REDHAT-BUG-2481314 is assessed as 33, indicating potential for significant impact if exploited.