Erlang OTP CVE-2024-46306: tar:extract/2 Arbitrary File Overwrite

漏洞概述 漏洞编号: CVE-2024-46306 漏洞名称: 在 GNU 稀疏成员末尾存在空字节漏洞 严重性: 中等（CVSS 评分 5.9/10） 描述: 当使用 函数（在 Erlang OTP 的 模块中）时，如果 tar 文件包含一个 GNU 稀疏成员，并且该成员在末尾有空字节，则可能导致任意文件覆盖。攻击者可以利用此漏洞覆盖目标文件，从而可能执行任意代码或导致拒绝服务。 影响范围 受影响版本: - OTP: 且 - stddlib: 修复版本: - OTP: - stddlib: 修复方案 更新版本: 将 OTP 更新到 或更高版本，将 stddlib 更新到 或更高版本。 临时缓解措施: 避免使用 函数处理不可信的 tar 文件，或者在提取前验证 tar 文件的完整性。 工作区 Pass: 与 一起使用，将 的 参数设置为 `{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{extract_opts, [{e

Goal Reached Thanks to every supporter — we hit 100%!

Erlang OTP CVE-2024-46306: tar:extract/2 Arbitrary File Overwrite

More from this source