USN-4777-1: node-tar vulnerability
15 March 2021
node-tar could be made to write arbitrary files to the filesystem if it opened a specially crafted tar archive.
Releases
Packages
- node-tar - read and write portable tar archives module for Node.js
Details
It was discovered that node-tar mishandled certain tar archives. An
attacker could use this vulnerability to write arbitrary files to the
filesystem.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
node-tar
-
1.0.3-2ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 14.04
-
node-tar
-
0.1.18-1ubuntu0.1~esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.