Path traversal in tar - CVE-2021-37713

Vulnerability identifier: #VU58204

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-37713

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due insufficient logic on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory.

tar
QRadar Pulse App
Netcool Operations Insight
IBM Security Verify Governance
QRadar User Behavior Analytics
QRadar Suite
IBM Watson Machine Learning Accelerator
QRadar Deployment Intelligence App
IBM Edge Application Manager
SUSE Linux Enterprise Module for Web Scripting
SINEC INS
IBM Cloud Pak System
IBM QRadar Data Synchronization App
nodejs12
nodejs12-debuginfo
nodejs12-debugsource
nodejs12-devel
npm12
nodejs12-docs
npm14
nodejs14-devel
nodejs14-debugsource
nodejs14-debuginfo
nodejs14-docs
nodejs14

Install update from vendor's website.

tar - addressed in versions 4.4.18, 5.0.10, 6.1.9
QRadar Pulse App - update to 2.2.9
Netcool Operations Insight - update to 1.6.5
QRadar Suite - update to 1.10.17.0
SINEC INS - update to 1.0.1.1
IBM Cloud Pak System - update to 2.3.3.5
IBM QRadar Data Synchronization App - update to 3.0.1
QRadar Deployment Intelligence App - update to 3.0.5
QRadar User Behavior Analytics - update to 4.1.11
nodejs12 - addressed in versions 12.22.7-4.22.1, 12.22.9-1.38.1
nodejs12-debuginfo - addressed in versions 12.22.7-4.22.1, 12.22.9-1.38.1
nodejs12-debugsource - addressed in versions 12.22.7-4.22.1, 12.22.9-1.38.1
nodejs12-devel - addressed in versions 12.22.7-4.22.1, 12.22.9-1.38.1
npm12 - addressed in versions 12.22.7-4.22.1, 12.22.9-1.38.1
nodejs12-docs - addressed in versions 12.22.7-4.22.1, 12.22.9-1.38.1
npm14 - addressed in versions 14.18.1-6.18.2, 14.18.1-15.21.2
nodejs14-devel - addressed in versions 14.18.1-6.18.2, 14.18.1-15.21.2
nodejs14-debugsource - addressed in versions 14.18.1-6.18.2, 14.18.1-15.21.2
nodejs14-debuginfo - addressed in versions 14.18.1-6.18.2, 14.18.1-15.21.2
nodejs14-docs - addressed in versions 14.18.1-6.18.2, 14.18.1-15.21.2
nodejs14 - addressed in versions 14.18.1-6.18.2, 14.18.1-15.21.2

• https://github.com/npm/node-tar/security/advisories/GHSA-5955-9wpr-37jh

• Multiple vulnerabilities in NPM Tar
• Multiple vulnerabilities in Siemens SINEC INS
• Multiple vulnerabilities in IBM QRadar Data Synchronization App
• SUSE update for nodejs14
• SUSE update for nodejs12
• SUSE update for nodejs14
• SUSE update for nodejs12
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Netcool Operations Insight
• Multiple vulnerabilities in IBM QRadar Pulse for QRadar SIEM
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in IBM QRadar Suite software
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App