Rocky Linux: CVE-2022-48303: tar (Multiple Advisories)

Rocky Linux: CVE-2022-48303: tar (Multiple Advisories)

Severity

5

CVSS

(AV:L/AC:M/Au:N/C:N/I:N/A:C)

Published

01/30/2023

Created

03/13/2024

Added

03/12/2024

Modified

01/28/2025

Description

GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters.

Solution(s)

• rocky-upgrade-tar
• rocky-upgrade-tar-debuginfo
• rocky-upgrade-tar-debugsource

References

• https://attackerkb.com/topics/cve-2022-48303
• CVE - 2022-48303
• https://errata.rockylinux.org/RLSA-2023:0842
• https://errata.rockylinux.org/RLSA-2023:0959