The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3237 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3237-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     December 12, 2022                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-tar     Version        : 4.4.6+ds1-3+deb10u2     CVE ID         : CVE-2021-37701 CVE-2021-37712     Debian Bug     : 993981

    Cache poisoning vulnerabilities were found in node-tar, a Node.js module     used to read and write portable tar archives, which may result in     arbitrary file creation or overwrite.

    CVE-2021-37701

        It was discovered that node-tar performed insufficient symlink         protection, thereby making directory cache vulnerable to poisoning         using symbolic links.

        Upon extracting an archive containing a directory 'foo/bar' followed         with a symbolic link 'foo\\bar' to an arbitrary location, node-tar         would extract arbitrary files into the symlink target, thus allowing         arbitrary file creation and overwrite.

        Moreover, on case-insensitive filesystems, a similar issue occurred         with a directory 'FOO' followed with a symbolic link 'foo'.

    CVE-2021-37712

        Similar to CVE-2021-37701, a specially crafted tar archive         containing two directories and a symlink with names containing         unicode values that normalized to the same value, would bypass         node-tar's symlink checks on directories, thus allowing arbitrary         file creation and overwrite.

    For Debian 10 buster, these problems have been fixed in version     4.4.6+ds1-3+deb10u2.

    We recommend that you upgrade your node-tar packages.

    For the detailed security status of node-tar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-tar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3237 : node-tar - security update

high Nessus Plugin ID 168639

Version 1.3

Version 1.2

Version 1.3 Jan 22, 2025, 8:38 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501222038
Version 1.2 Dec 12, 2022, 11:43 PM New Plugin Feed: 202212122343