CVE:CVE-2021-37701
CNNVD:CNNVD-202108-2802
node-tar是一款用于文件压缩/解压缩的软件包。
Node-tar 中存在后置链接漏洞，该漏洞源于产品未对特殊字符做有效验证。攻击者可通过该漏洞在其他路径创建恶意文件。
solution:Upgrade npmjs tar to a higher version than 4.4.16,5.0.8,6.1.7,and avoid the version (,4.4.16),[5.0.0,5.0.8),[6.0.0,6.1.7); Upgrade debian debian_linux to a higher version than 10.0,11.0,and avoid the version 10.0,11.0; Upgrade oracle graalvm to a higher version than 20.3.3,21.2.0,and avoid the version 20.3.3,21.2.0; Upgrade siemens sinec_infrastructure_network_services to a higher version than 1.0.1.1,and avoid the version (,1.0.1.1)