Bug 1191963 – VUL-0: CVE-2021-32803: nodejs14,nodejs12,nodejs6,nodejs4,nodejs10,nodejs8: node-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite

Bug 1191963 - (CVE-2021-32803) VUL-0: CVE-2021-32803: nodejs14,nodejs12,nodejs6,nodejs4,nodejs10,nodejs8: node-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite

(CVE-2021-32803)
Summary:	VUL-0: CVE-2021-32803: nodejs14,nodejs12,nodejs6,nodejs4,nodejs10,nodejs8: no...

Status:	NEW

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/305697/
Whiteboard:	CVSSv3.1:SUSE:CVE-2021-32803:8.1:(AV:...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2021-10-22 15:50 UTC by Gabriele Sonnu
Modified:	2022-05-17 19:21 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Gabriele Sonnu 2021-10-22 15:50:03 UTC

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

References:
https://www.npmjs.com/advisories/1771
https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw
https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20
https://www.npmjs.com/package/tar

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1990415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32803
https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw
https://github.com/npm/node-tar/commit/9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20
https://www.npmjs.com/package/tar
https://www.npmjs.com/advisories/1771

Comment 1 Gabriele Sonnu 2021-10-26 12:36:18 UTC

Affected packages:

- openSUSE:Factory/nodejs16          16.6.2   (node-tar 6.1.0)
- SUSE:SLE-12:Update/nodejs10       10.24.1   (node-tar 4.4.13)
- SUSE:SLE-15:Update/nodejs10       10.24.1   (node-tar 4.4.13)
- SUSE:SLE-15:Update/nodejs8         8.17.0   (node-tar 4.4.13)
- SUSE:SLE-15-SP2:Update/nodejs8     8.17.0   (node-tar 4.4.13)

Comment 7 Swamp Workflow Management 2022-02-21 14:20:17 UTC

SUSE-SU-2022:0531-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs12-12.22.10-1.42.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 8 Adam Majer 2022-02-22 13:14:40 UTC

All codestreams affected are submitted. Reassigning to security-team

Comment 9 Swamp Workflow Management 2022-02-24 11:24:10 UTC

SUSE-SU-2022:0563-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise Server for SAP 15 (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise Server 15-SP1-BCL (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise Server 15-LTSS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    nodejs8-8.17.0-3.54.2
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    nodejs8-8.17.0-3.54.2
SUSE Enterprise Storage 6 (src):    nodejs8-8.17.0-3.54.2
SUSE CaaS Platform 4.0 (src):    nodejs8-8.17.0-3.54.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 10 Swamp Workflow Management 2022-02-24 14:21:30 UTC

SUSE-SU-2022:0570-1: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696,1194514
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918,CVE-2022-21824
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs10-10.24.1-1.46.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2022-02-24 14:23:11 UTC

SUSE-SU-2022:0569-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Web Scripting 12 (src):    nodejs14-14.19.0-6.24.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 12 Swamp Workflow Management 2022-03-02 14:18:05 UTC

SUSE-SU-2022:0657-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    nodejs12-12.22.10-4.29.3
SUSE Manager Retail Branch Server 4.1 (src):    nodejs12-12.22.10-4.29.3
SUSE Manager Proxy 4.1 (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise Server 15-SP2-BCL (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise Module for Web Scripting 15-SP3 (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    nodejs12-12.22.10-4.29.3
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    nodejs12-12.22.10-4.29.3
SUSE Enterprise Storage 7 (src):    nodejs12-12.22.10-4.29.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 13 Swamp Workflow Management 2022-03-02 14:21:37 UTC

openSUSE-SU-2022:0657-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    nodejs12-12.22.10-4.29.3
openSUSE Leap 15.3 (src):    nodejs12-12.22.10-4.29.3

Comment 14 Swamp Workflow Management 2022-03-03 20:29:40 UTC

SUSE-SU-2022:0704-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Manager Retail Branch Server 4.1 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Manager Proxy 4.1 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise Server for SAP 15 (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise Server 15-SP2-BCL (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise Server 15-LTSS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    nodejs-common-2.0-3.4.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    nodejs-common-2.0-3.4.1
SUSE Enterprise Storage 7 (src):    nodejs-common-2.0-3.4.1, nodejs8-8.17.0-10.19.2
SUSE Enterprise Storage 6 (src):    nodejs-common-2.0-3.4.1
SUSE CaaS Platform 4.0 (src):    nodejs-common-2.0-3.4.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Swamp Workflow Management 2022-03-03 20:32:23 UTC

openSUSE-SU-42022-1: An update that fixes 14 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1038980,1191962,1191963,1192153,1192154,1192696,1195230,1195682
CVE References: CVE-2017-8923,CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918,CVE-2022-22753,CVE-2022-22754,CVE-2022-22756,CVE-2022-22759,CVE-2022-22760,CVE-2022-22761,CVE-2022-22763,CVE-2022-22764
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    MozillaFirefox-91.6.0-152.15.1
openSUSE Leap 15.3 (src):    nodejs8-8.17.0-10.19.2, php7-7.4.6-3.32.1, php7-test-7.4.6-3.32.1

Comment 16 Swamp Workflow Management 2022-03-04 08:29:17 UTC

openSUSE-SU-22022:20000-2: An update that fixes 6 vulnerabilities is now available.

Category: security (important)
Bug References: 1038980,1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2017-8923,CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    nodejs8-8.17.0-10.19.2, php7-7.4.6-3.32.1, php7-test-7.4.6-3.32.1

Comment 17 Swamp Workflow Management 2022-03-04 08:57:13 UTC

openSUSE-SU-2022:0704-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    nodejs8-8.17.0-10.19.2
openSUSE Leap 15.3 (src):    nodejs8-8.17.0-10.19.2

Comment 18 Swamp Workflow Management 2022-03-04 14:22:25 UTC

openSUSE-SU-2022:0715-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    nodejs14-14.19.0-15.27.1
openSUSE Leap 15.3 (src):    nodejs14-14.19.0-15.27.1

Comment 19 Swamp Workflow Management 2022-03-04 14:26:35 UTC

SUSE-SU-2022:0715-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    nodejs14-14.19.0-15.27.1
SUSE Manager Retail Branch Server 4.1 (src):    nodejs14-14.19.0-15.27.1
SUSE Manager Proxy 4.1 (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Module for Web Scripting 15-SP4 (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise Module for Web Scripting 15-SP3 (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    nodejs14-14.19.0-15.27.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    nodejs14-14.19.0-15.27.1
SUSE Enterprise Storage 7 (src):    nodejs14-14.19.0-15.27.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 21 Swamp Workflow Management 2022-05-17 19:21:33 UTC

SUSE-SU-2022:1717-1: An update that fixes 9 vulnerabilities is now available.

Category: security (important)
Bug References: 1191962,1191963,1192153,1192154,1192696,1194514,1194819,1197283,1198247
CVE References: CVE-2021-23343,CVE-2021-32803,CVE-2021-32804,CVE-2021-3807,CVE-2021-3918,CVE-2021-44906,CVE-2021-44907,CVE-2022-0235,CVE-2022-21824
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    nodejs10-10.24.1-150000.1.44.1
openSUSE Leap 15.3 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Manager Server 4.1 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Manager Retail Branch Server 4.1 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Manager Proxy 4.1 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server for SAP 15 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise Server 15-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Enterprise Storage 7 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE Enterprise Storage 6 (src):    nodejs10-10.24.1-150000.1.44.1
SUSE CaaS Platform 4.0 (src):    nodejs10-10.24.1-150000.1.44.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.