IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek

CVE-2026-23950node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS

isaacs node-tar; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Dev Spaces 3.27 Yayım: (9 ay önce)

Açıklama

node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.

Zayıflık türü (CWE): CWE-176CWE-352CWE-367

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
isaacs node-tar < 7.5.4
isaacs tar < 7.5.4
openshift devspaces 3.27 —
Red Hat Confidential Compute Attestation all versions
Red Hat Cryostat 4 —
Red Hat Logging Subsystem for Red Hat OpenShift all versions
Red Hat Migration Toolkit for Containers all versions
Red Hat Multicluster Engine for Kubernetes —
Red Hat Network Observability Operator all versions
Red Hat Node HealthCheck Operator —
Red Hat OpenShift Lightspeed all versions
Red Hat OpenShift Pipelines all versions
Red Hat OpenShift Serverless all versions
Red Hat Red Hat 3scale API Management Platform 2 all versions
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 —
Red Hat Red Hat AMQ Broker 7 —
Red Hat Red Hat Ansible Automation Platform 2 —
Red Hat Red Hat build of Apache Camel - HawtIO 4 —
Red Hat Red Hat Connectivity Link 1 all versions
Red Hat Red Hat Developer Hub all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 7 —
Red Hat Red Hat Enterprise Linux 8 —
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 all versions
Red Hat Red Hat Fuse 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7 —
Red Hat Red Hat JBoss Enterprise Application Platform 8 —
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack —
Red Hat Red Hat OpenShift AI (RHOAI) all versions
Red Hat Red Hat OpenShift Container Platform 4 all versions
Red Hat Red Hat Openshift Data Foundation 4 all versions
Red Hat Red Hat OpenShift Dev Spaces 3.27 all versions
Red Hat Red Hat OpenShift GitOps all versions
Red Hat Red Hat Process Automation 7 —
Red Hat Red Hat Quay 3 —
Red Hat Red Hat Satellite 6 all versions
Red Hat Red Hat Single Sign-On 7 —
Red Hat Red Hat Trusted Artifact Signer 1.2 all versions
Red Hat Red Hat Trusted Artifact Signer 1.3 all versions
trusted artifact signer 1.2 —
trusted artifact signer 1.3 —

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (1)
  • cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* < 7.5.4

Aynı üründe son açıklar — Red Hat Enterprise Linux

5.5Orta
CVE-2026-110330

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Yüksek
CVE-2026-110331

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…