REDHAT-BUG-2515509: High severity npm/node-tar vulnerability
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-tarto a version that resolves this vulnerability.Fixed in 7.5.21
Event History
Frequently Asked Questions
Which uses are exposed to this denial-of-service condition?
Applications using tar.t(...) or tar.x(...) with a non-empty member-selection list are exposed when processing a crafted archive. The failure affects asynchronous and streaming Node.js consumers.
What does an attacker need to trigger the issue?
An attacker needs to supply a tar archive containing a GNU L or PAX x long-path header with thousands of slash-separated path segments. The crafted path is processed before the unpacking maxDepth check is applied.
What is the impact of successful exploitation?
Processing the archive can cause an uncatchable RangeError stack overflow. This terminates the affected Node.js process or consumer.
What is the remediation?
Update node-tar to version 7.5.21, which fixes the issue. Until updating, avoid processing untrusted archives with tar.t(...) or tar.x(...) when a non-empty member-selection list is used.