Alpine: nodejs: security update to 12.22.6-r0

high Tenable Cloud Security Plugin ID 405801

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file
creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file
whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by
ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat
calls to determine whether a given path is a directory, paths are cached when directories are created.
This logic was insufficient when extracting tar files that contained both a directory and a symlink with
the same name as the directory, where the symlink and directory names in the archive entry used
backslashes as a path separator on posix systems. The cache checking logic used both `\` and `/`
characters as path separators, however `\` is a valid filename character on posix systems. By first
creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass
node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an
arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary
file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive
filesystems. If a tar archive contained a directory at `FOO`, followed by a symbolic link named `foo`,
then on case-insensitive file systems, the creation of the symbolic link would remove the directory from
the filesystem, but _not_ from the internal directory cache, as it would not be treated as a cache hit. A
subsequent file entry within the `FOO` directory would then be placed in the target of the symbolic link,
thinking that the directory had already been created. These issues were addressed in releases 4.4.16,
5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these
issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar.
If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc. (CVE-2021-37701)

- The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file
creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file
whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by
ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat
calls to determine whether a given path is a directory, paths are cached when directories are created.
This logic was insufficient when extracting tar files that contained both a directory and a symlink with
names containing unicode values that normalized to the same value. Additionally, on Windows systems, long
path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A
specially crafted tar archive could thus include a directory with one form of the path, followed by a
symbolic link with a different string that resolves to the same file system entity, followed by a file
using the first form. By first creating a directory, and then replacing that directory with a symlink that
had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to
bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into
an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing
arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9.
The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are
still using a v3 release we recommend you update to a more recent version of node-tar. If this is not
possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p. (CVE-2021-37712)

- The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file
creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file
whose location would be outside of the extraction target directory is not extracted. This is, in part,
accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that
contain `..` path portions, and resolving the sanitized paths against the extraction target directory.
This logic was insufficient on Windows systems when extracting tar files that contained a path that was
not an absolute path, but specified a drive letter different from the extraction target, such as
`C:some\path`. If the drive letter does not match the extraction target, for example `D:\extraction\dir`,
then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current
working directory on the `C:` drive, rather than the extraction target directory. Additionally, a `..`
portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not
properly sanitized by the logic that checked for `..` within the normalized and split portions of the
path. This only affects users of `node-tar` on Windows systems. These issues were addressed in releases
4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for
these issues. If you are still using a v3 release we recommend you update to a more recent version of
node-tar. There is no reasonable way to work around this issue without performing the same path
normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched
versions of node-tar, rather than attempt to sanitize paths themselves. (CVE-2021-37713)

- `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder
hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be
met, and the extraction of package contents will always be performed into the expected folder. This is, in
part, accomplished by resolving dependency specifiers defined in `package.json` manifests for dependencies
with a specific name, and nesting folders to resolve conflicting dependencies. When multiple dependencies
differ only in the case of their name, Arborist's internal data structure saw them as separate items that
could coexist within the same level in the `node_modules` hierarchy. However, on case-insensitive file
systems (such as macOS and Windows), this is not the case. Combined with a symlink dependency such as
`file:/some/path`, this allowed an attacker to create a situation in which arbitrary contents could be
written to any location on the filesystem. For example, a package `pwn-a` could define a dependency in
their `package.json` file such as `"foo": "file:/some/path"`. Another package, `pwn-b` could define a
dependency such as `FOO: "file:foo.tgz"`. On case-insensitive file systems, if `pwn-a` was installed, and
then `pwn-b` was installed afterwards, the contents of `foo.tgz` would be written to `/some/path`, and any
existing contents of `/some/path` would be removed. Anyone using npm v7.20.6 or earlier on a case-
insensitive filesystem is potentially affected. This is patched in @npmcli/arborist 2.8.2 which is
included in npm v7.20.7 and above. (CVE-2021-39134)

- `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder
hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be
met, and the extraction of package contents will always be performed into the expected folder. This is
accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules`
folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could
allow Arborist to write package dependencies to any arbitrary location on the file system. Note that
symbolic links contained within package artifact contents are filtered out, so another means of creating a
`node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace
`node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could
supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the
root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making
changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist
2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see
the referenced GHSA-gmw6-94gg-2rc2. (CVE-2021-39135)

Plugin Details

Severity: High

ID: 405801

Version: Revision 1.24

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 3/13/2025

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.66

CVSS v2

Risk Factor: Medium

Base Score: 4.4

Temporal Score: 3.3

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-39135

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2021-37713

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/31/2021

Reference Information

CVE: CVE-2021-37701, CVE-2021-37712, CVE-2021-37713, CVE-2021-39134, CVE-2021-39135

Detections

Analytics