Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value. A crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size.
| Vendor | Product | Versions |
|---|---|---|
| archive\ | \ | 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| red hat | enterprise linux | cert_advisory | 90% |
Updated description with more technical detail, changed affected versions to include 3.9, updated severity to HIGH, and noted that there is no available exploit.
Updated description, vendor to CPAN Security Group, product to Archive-Tar, affected versions to 'before 3.10', severity to HIGH, CVSS estimate to 7.5, CWE to CWE-789, exploitAvailable to true, added MITRE ATT&CK technique T1595.002, and tags 'memory exhaustion' and 'denial of service'.
Initial creation
