Description (CNA)
node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| isaacs / node-tar | affected = 7.5.1 |
CWE
CWE-362, CWE-367
References
- https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph
- https://github.com/isaacs/node-tar/issues/445
- https://github.com/isaacs/node-tar/pull/446
- https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d
ADP enrichment
No English description supplied.
No references supplied.