Description
modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ayuhito modern-tar
Default version status: unaffected
0.3.5 to ≤ 0.8.5affected
pkg:npm/modern-tarReferences
- https://github.com/ayuhito/modern-tar/pull/195 ↗
- https://github.com/ayuhito/modern-tar/commit/181c8cb75351867535057817ada4802a90fe416e ↗
- https://github.com/ayuhito/modern-tar/blob/v0.8.5/src/tar/encoding.ts ↗
- https://github.com/ayuhito/modern-tar ↗
- https://www.vulncheck.com/advisories/modern-tar-0.3.5-through-0.8.5-memory-exhaustion-via-malformed-octal-size-field ↗