CVE-2024-28863

A flaw was found in ISAACS's node-tar, where it is vulnerable to a denial of service, caused by the lack of folder count validation. The vulnerability exists due to the application not properly controlling the consumption of internal resources while parsing a tar file. By sending a specially crafted request, a remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Moderate impact in Red Hat products: node-tar is vulnerable to denial of service while parsing a specially crafted tar archive because it does not validate folder depth or count. A remote attacker who can cause a product to process such an archive can exhaust memory and crash the Node.js client. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), reflecting network reachability with required user interaction and high availability impact, without confidentiality or integrity impact. The current assessment includes affected and new entries across Red Hat Satellite, Red Hat OpenShift, Red Hat Enterprise Linux nodejs components, Ansible Services, and other products; 13 product/component entries are not affected, including RHEL polkit, OpenShift networking-console-plugin, and Red Hat Discovery discovery-server-container, because those entries are outside the vulnerable node-tar parsing scope. Affected entries are delegated to product teams pursuing fixes or appropriate downstream disposition; entries explicitly marked WONTFIX or OOSS retain those recorded dispositions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.