Stay Secure with the Latest Linux Advisories

security advisorymoderatedebian

Debian Bullseye DSA-5008-1 Moderate: Node-Tar Symlink Bypass

It was discovered that the symlink extraction protections in node-tar, a Tar archives module for Node.js could by bypassed; allowing a malicious Tar archive to symlink into an arbitrary location. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5008-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Moritz Muehlenhoff November 11, 2021 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : node-tar CVE ID : CVE-2021-37701 CVE-2021-37712 It was discovered that the symlink extraction protections in node-tar, a Tar archives module for Node.js could by bypassed; allowing a malicious Tar archive to symlink into an arbitrary location. For the stable distribution (bullseye), these problems have been fixed in version 6.0.5+ds1+~cs11.3.9-1+deb11u2. We recommend that you upgrade your node-tar packages. For the detailed security status of node-tar please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/node-tar Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Address vulnerabilities in node-tar by following advisory DSA-5008-1, focusing on symbolic link extraction issues. Implement best practices for enhanced security against threats. node-tar Security, Debian DSA-5008-1, Symlink Protection, Tar Archive Module. . LinuxSecurity.com Team

Nov 11, 2021 Debian