Detections
Analytics

SCA: security update for tar (GHSA-3jfq-g458-7qm9)

high Tenable Cloud Security Plugin ID 409572

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File
 Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent
 extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths`
 flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file
 paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This
 logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`.
 `node-tar` would only strip a single path root from such paths. When given an absolute file path with
 repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute
 path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2,
 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom
 `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute
 paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in
 later versions of tar. (CVE-2021-32804)

See Also

https://github.com/advisories/GHSA-3jfq-g458-7qm9

Plugin Details

Severity: High

ID: 409572

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.37

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2021-32804

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/3/2021

Vulnerability Publication Date: 8/3/2021

Reference Information

CVE: CVE-2021-32804

cwe: CWE-22