node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-749 advisory.

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to     restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files     that they do not have explicit read access to. (CVE-2024-22018)

    A security flaw in Node.js  allows a bypass of network import restrictions.By embedding non-network     imports in data URLs, an attacker can execute arbitrary code, compromising system security.Verified on     various platforms, the vulnerability is mitigated by forbidding data URLs in network imports.Exploiting     this flaw can violate network import security, posing a risk to developers and servers. (CVE-2024-22020)

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

    A vulnerability has been identified in Node.js, affecting users of the experimental permission model when     the --allow-fs-write flag is used.

    Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or     fs.fchmod can use a read-only file descriptor to change the owner and permissions of a file.
    (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6147 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6148 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)

    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6148 advisory.

    nodejs     [1:18.20.4-1]
    - Update to 18.20.4       Fixes: CVE-2024-22020 CVE-2024-28863

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-6147 advisory.

    nodejs     [1:18.20.4-1]
    - Update to 18.20.4       Fixes: CVE-2024-22020 CVE-2024-28863

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6147 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6148 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5814 advisory.

    nodejs     [1:20.16.0-1]
    - Update to 20.16.0       Fixes: CVE-2024-36137 CVE-2024-22018 CVE-2024-22020

    nodejs-nodemon     nodejs-packaging

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5814 advisory.

    * node-tar: denial of service while parsing a tar file due to lack of folders depth validation     (CVE-2024-28863)
    * nodejs: Bypass network import restriction via data URL (CVE-2024-22020)
    * nodejs: fs.lstat bypasses permission model (CVE-2024-22018)
    * nodejs: fs.fchown/fchmod bypasses permission model (CVE-2024-36137)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of nodejs18 / nodejs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-28863 advisory.

  - node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders     created in the folder creation process. An attacker who generates a large number of sub-folders can     consume memory on the system running node-tar and even crash the Node.js client within few seconds of     running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing     extraction in excessively deep sub-folders. (CVE-2024-28863)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In the nodejs module node-tar prior to version 6.2.1, there is no validation of the number of folders created while unpacking a file. As a result, an attacker can use a malicious file to exhaust the CPU and memory on the host and crash the nodejs client.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210001	Amazon Linux 2023 : nodejs20, nodejs20-devel, nodejs20-full-i18n (ALAS2023-2024-749)	Nessus	Amazon Linux Local Security Checks	medium
207306	Rocky Linux 9 : nodejs:18 (RLSA-2024:6147)	Nessus	Rocky Linux Local Security Checks	medium
207305	Rocky Linux 8 : nodejs:18 (RLSA-2024:6148)	Nessus	Rocky Linux Local Security Checks	medium
206618	Oracle Linux 8 : nodejs:18 (ELSA-2024-6148)	Nessus	Oracle Linux Local Security Checks	medium
206617	Oracle Linux 9 : nodejs:18 (ELSA-2024-6147)	Nessus	Oracle Linux Local Security Checks	medium
206476	AlmaLinux 9 : nodejs:18 (ALSA-2024:6147)	Nessus	Alma Linux Local Security Checks	medium
206474	AlmaLinux 8 : nodejs:18 (ALSA-2024:6148)	Nessus	Alma Linux Local Security Checks	medium
206219	Oracle Linux 8 : nodejs:20 (ELSA-2024-5814)	Nessus	Oracle Linux Local Security Checks	medium
206217	AlmaLinux 8 : nodejs:20 (ALSA-2024:5814)	Nessus	Alma Linux Local Security Checks	medium
202196	CBL Mariner 2.0 Security Update: nodejs18 / nodejs (CVE-2024-28863)	Nessus	MarinerOS Local Security Checks	medium
192685	Node.js Module node-tar < 6.2.1 DoS	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-28863

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium