onyx --cves cve-2021-32610
CVE-2021-32610
- score
- <0.1
- cvss
- 7.1
- epss
- 73.4%
- published
- 2021-07-30
- kev added
- —
- first seen
Archive_Tar < 1.4.14 contains a path traversal caused by symlinks referring to targets outside of the archive, letting attackers extract files to arbitrary locations, exploit requires crafted archive.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 9
- https://github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755
- https://www.drupal.org/sa-core-2021-004
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAODVMHGL5MHQWQAQTXQ7G7OE3VQZ7LS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G5LTY6COQYNMMHQJ3QIOJHEWCKD4XDFH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/
- https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f
- https://github.com/pear/Archive_Tar/releases/tag/1.4.14
- https://lists.debian.org/debian-lts-announce/2021/07/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/