CVE-2021-20193

low-risk

Published 2021-03-26

A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 3.3/10 Low

LOCAL / LOW complexity

Affected Products (1)

Tar

Affected Vendors

Gnu

References (8)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1917565

Mailing List https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a47...

Issue Tracking https://savannah.gnu.org/bugs/?59897

Third Party Advisory https://security.gentoo.org/glsa/202105-29

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1917565

Mailing List https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a47...

Issue Tracking https://savannah.gnu.org/bugs/?59897

Third Party Advisory https://security.gentoo.org/glsa/202105-29

/ 100

low-risk

Severity 13/34 · Low

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal