1191962 – (CVE-2021-32804) VUL-0: CVE-2021-32804: nodejs12,nodejs8,nodejs14,nodejs4,nodejs10,nodejs6: node-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite

Bug 1191962 (CVE-2021-32804) - VUL-0: CVE-2021-32804: nodejs12,nodejs8,nodejs14,nodejs4,nodejs10,nodejs6: node-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite

Summary: VUL-0: CVE-2021-32804: nodejs12,nodejs8,nodejs14,nodejs4,nodejs10,nodejs6: no...

Status:	RESOLVED FIXED

Alias:	CVE-2021-32804

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/305696/
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-32804:8.1:(AV:...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2021-10-22 15:44 UTC by Gabriele Sonnu
Modified:	2024-05-29 12:09 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Gabriele Sonnu 2021-10-22 15:44:18 UTC

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

References:
https://www.npmjs.com/advisories/1770
https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4
https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9
https://www.npmjs.com/package/tar

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1990409
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-32804
https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9
https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32804
https://www.npmjs.com/package/tar
https://www.npmjs.com/advisories/1770

Comment 1 Gabriele Sonnu 2021-10-26 12:37:51 UTC

Affected packages:

- openSUSE:Factory/nodejs16          16.6.2   (node-tar 6.1.0)
- SUSE:SLE-12:Update/nodejs10       10.24.1   (node-tar 4.4.13)
- SUSE:SLE-15:Update/nodejs10       10.24.1   (node-tar 4.4.13)
- SUSE:SLE-15:Update/nodejs8         8.17.0   (node-tar 4.4.13)
- SUSE:SLE-15-SP2:Update/nodejs8     8.17.0   (node-tar 4.4.13)

Comment 7 Swamp Workflow Management 2022-02-21 14:20:12 UTC

SUSE-SU-2022:0531-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs12-12.22.10-1.42.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 8 Adam Majer 2022-02-22 13:18:21 UTC

All codestreams affected are submitted. Reassigning to security-team

Comment 9 Swamp Workflow Management 2022-02-24 11:24:06 UTC

SUSE-SU-2022:0563-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise Server for SAP 15 (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise Server 15-SP1-BCL (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise Server 15-LTSS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    nodejs8-8.17.0-3.54.2
SUSE Enterprise Storage 6 (src):    nodejs8-8.17.0-3.54.2
SUSE CaaS Platform 4.0 (src):    nodejs8-8.17.0-3.54.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Swamp Workflow Management 2022-02-24 14:21:25 UTC

SUSE-SU-2022:0570-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696,1194514
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918,CVE-2022-21824
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs10-10.24.1-1.46.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2022-02-24 14:23:06 UTC

SUSE-SU-2022:0569-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs14-14.19.0-6.24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Swamp Workflow Management 2022-03-02 14:18:01 UTC

SUSE-SU-2022:0657-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    nodejs12-12.22.10-4.29.3
SUSE Manager Retail Branch Server 4.1 (src):    nodejs12-12.22.10-4.29.3
SUSE Manager Proxy 4.1 (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise Server 15-SP2-BCL (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise Module for Web Scripting 15-SP3 (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    nodejs12-12.22.10-4.29.3
SUSE Enterprise Storage 7 (src):    nodejs12-12.22.10-4.29.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Swamp Workflow Management 2022-03-02 14:21:32 UTC

openSUSE-SU-2022:0657-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    nodejs12-12.22.10-4.29.3
openSUSE Leap 15.3 (src):    nodejs12-12.22.10-4.29.3

Comment 14 Swamp Workflow Management 2022-03-03 20:29:36 UTC

SUSE-SU-2022:0704-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Manager Retail Branch Server 4.1 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Manager Proxy 4.1 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise Server for SAP 15 (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise Server 15-SP2-BCL (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise Server 15-LTSS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    nodejs-common-2.0-3.4.1
SUSE Enterprise Storage 7 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Enterprise Storage 6 (src):    nodejs-common-2.0-3.4.1
SUSE CaaS Platform 4.0 (src):    nodejs-common-2.0-3.4.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Swamp Workflow Management 2022-03-03 20:32:19 UTC

openSUSE-SU-42022-1: An update that fixes 14 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1038980,1191962,1191963,1192153,1192154,1192696,1195230,1195682
CVE References: CVE-2017-8923,CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918,CVE-2022-22753,CVE-2022-22754,CVE-2022-22756,CVE-2022-22759,CVE-2022-22760,CVE-2022-22761,CVE-2022-22763,CVE-2022-22764
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    MozillaFirefox-91.6.0-152.15.1
openSUSE Leap 15.3 (src):    nodejs8-8.17.0-10.19.2, php7-7.4.6-3.32.1, php7-test-7.4.6-3.32.1

Comment 16 Swamp Workflow Management 2022-03-04 08:29:13 UTC

openSUSE-SU-22022:20000-2: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1038980,1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2017-8923,CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    nodejs8-8.17.0-10.19.2, php7-7.4.6-3.32.1, php7-test-7.4.6-3.32.1

Comment 17 Swamp Workflow Management 2022-03-04 08:57:09 UTC

openSUSE-SU-2022:0704-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    nodejs8-8.17.0-10.19.2
openSUSE Leap 15.3 (src):    nodejs8-8.17.0-10.19.2

Comment 18 Swamp Workflow Management 2022-03-04 14:22:20 UTC

openSUSE-SU-2022:0715-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    nodejs14-14.19.0-15.27.1
openSUSE Leap 15.3 (src):    nodejs14-14.19.0-15.27.1

Comment 19 Swamp Workflow Management 2022-03-04 14:26:31 UTC

SUSE-SU-2022:0715-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    nodejs14-14.19.0-15.27.1
SUSE Manager Retail Branch Server 4.1 (src):    nodejs14-14.19.0-15.27.1
SUSE Manager Proxy 4.1 (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Module for Web Scripting 15-SP4 (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Module for Web Scripting 15-SP3 (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    nodejs14-14.19.0-15.27.1
SUSE Enterprise Storage 7 (src):    nodejs14-14.19.0-15.27.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 21 Swamp Workflow Management 2022-05-17 19:21:28 UTC

SUSE-SU-2022:1717-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696,1194514,1194819,1197283,1198247
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918,CVE-2021-44906,CVE-2021-44907,CVE-2022-0235,CVE-2022-21824
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    nodejs10-10.24.1-150000.1.44.1
openSUSE Leap 15.3 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Manager Server 4.1 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Manager Retail Branch Server 4.1 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Manager Proxy 4.1 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server for SAP 15 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Enterprise Storage 7 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Enterprise Storage 6 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE CaaS Platform 4.0 (src):    nodejs10-10.24.1-150000.1.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 23 Andrea Mattiazzo 2024-05-29 12:09:20 UTC

All done, closing.