node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-766 advisory.

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-768 advisory.

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to     restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files     that they do not have explicit read access to. (CVE-2024-22018)

    A security flaw in Node.js  allows a bypass of network import restrictions.By embedding non-network     imports in data URLs, an attacker can execute arbitrary code, compromising system security.Verified on     various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.Exploiting     this flaw can violate network import security, posing a risk to developers and servers. (CVE-2024-22020)

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used.

    Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or     fs.fchmod can use a read-only file descriptor to change the owner and permissions of a file.
    (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5814 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

    * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)

    * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6148 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6147 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    Security Fix(es):

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8906 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    * mosquitto: sending specific sequences of packets may trigger memory leak     (CVE-2024-8376)
    * micromatch: vulnerable to Regular Expression Denial of Service (CVE-2024-4067)     urllib3: proxy-authorization request header is not stripped during cross-origin redirects (CVE-2024-37891)
    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * python-django: Potential denial-of-service in django.utils.html.urlize() (CVE-2024-38875)
    * python-django: Username enumeration through timing difference for users with unusable passwords     (CVE-2024-39329)
    * python-django: Potential directory-traversal in django.core.files.storage.Storage.save()     (CVE-2024-39330)
    * python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()     (CVE-2024-39614)
    * github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp     (CVE-2024-5569)
    * puppet-foreman: An authentication bypass vulnerability exists in Foreman (CVE-2024-7012)
    * python-django: Potential SQL injection in QuerySet.values() and values_list() (CVE-2024-42005)
    * grpc: client communicating with a HTTP/2 proxy can poison the HPACK table between the proxy and the     backend (CVE-2024-7246)
    * puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore (CVE-2024-7923)
    * foreman: Read-only access to entire DB from templates (CVE-2024-8553)

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-749 advisory.

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to     restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files     that they do not have explicit read access to. (CVE-2024-22018)

    A security flaw in Node.js  allows a bypass of network import restrictions.By embedding non-network     imports in data URLs, an attacker can execute arbitrary code, compromising system security.Verified on     various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.Exploiting     this flaw can violate network import security, posing a risk to developers and servers. (CVE-2024-22020)

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used.

    Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or     fs.fchmod can use a read-only file descriptor to change the owner and permissions of a file.
    (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6147 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6148 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6148 advisory.

    nodejs     [1:18.20.4-1]
    - Update to 18.20.4       Fixes: CVE-2024-22020 CVE-2024-28863

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6147 advisory.

    nodejs     [1:18.20.4-1]
    - Update to 18.20.4       Fixes: CVE-2024-22020 CVE-2024-28863

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6147 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6148 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5814 advisory.

    nodejs     [1:20.16.0-1]
    - Update to 20.16.0       Fixes: CVE-2024-36137 CVE-2024-22018 CVE-2024-22020

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5814 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
    * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
    * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nodejs18 / nodejs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28863 advisory.

  - node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In the nodejs module node-tar prior to version 6.2.1, there is no validation of the number of folders created while unpacking a file. As a result, an attacker can use a malicious file to exhaust the CPU and memory on the host and crash the nodejs client.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211372	Amazon Linux 2023 : nodejs, nodejs-devel, nodejs-full-i18n (ALAS2023-2024-766)	Nessus	Amazon Linux Local Security Checks	medium
211368	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-768)	Nessus	Amazon Linux Local Security Checks	medium
210568	RHEL 8 : nodejs:20 (RHSA-2024:5814)	Nessus	Red Hat Local Security Checks	medium
210503	RHEL 8 : nodejs:18 (RHSA-2024:6148)	Nessus	Red Hat Local Security Checks	medium
210493	RHEL 9 : nodejs:18 (RHSA-2024:6147)	Nessus	Red Hat Local Security Checks	medium
210402	RHEL 8 / 9 : Satellite 6.16.0 (Critical) (RHSA-2024:8906)	Nessus	Red Hat Local Security Checks	high
210001	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-749)	Nessus	Amazon Linux Local Security Checks	medium
207306	Rocky Linux 9 : nodejs:18 (RLSA-2024:6147)	Nessus	Rocky Linux Local Security Checks	medium
207305	Rocky Linux 8 : nodejs:18 (RLSA-2024:6148)	Nessus	Rocky Linux Local Security Checks	medium
206618	Oracle Linux 8 : nodejs:18 (ELSA-2024-6148)	Nessus	Oracle Linux Local Security Checks	medium
206617	Oracle Linux 9 : nodejs:18 (ELSA-2024-6147)	Nessus	Oracle Linux Local Security Checks	medium
206476	AlmaLinux 9 : nodejs:18 (ALSA-2024:6147)	Nessus	Alma Linux Local Security Checks	medium
206474	AlmaLinux 8 : nodejs:18 (ALSA-2024:6148)	Nessus	Alma Linux Local Security Checks	medium
206219	Oracle Linux 8 : nodejs:20 (ELSA-2024-5814)	Nessus	Oracle Linux Local Security Checks	medium
206217	AlmaLinux 8 : nodejs:20 (ALSA-2024:5814)	Nessus	Alma Linux Local Security Checks	medium
202196	CBL Mariner 2.0 Security Update: nodejs18 / nodejs (CVE-2024-28863)	Nessus	MarinerOS Local Security Checks	medium
192685	Node.js Module node-tar < 6.2.1 DoS	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-28863

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium