CVE-2021-30139

Name
CVE-2021-30139
Description
In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://gitlab.alpinelinux.org/alpine/aports/-/issues/12606
MISC https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/10741

Match rules

CPE URI Source package Min version Max version
cpe:2.3:o:alpinelinux:apk-tools:*:*:*:*:*:*:*:* apk-tools >= None < 2.10.6
cpe:2.3:o:alpinelinux:apk-tools:*:*:*:*:*:*:*:* apk-tools >= 2.12.0 < 2.12.5

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
apk-tools edge-main 2.12.5-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
apk-tools 3.22-main 2.12.5-r0 None fixed
apk-tools 3.21-main 2.12.5-r0 None fixed
apk-tools 3.20-main 2.12.5-r0 None fixed
apk-tools 3.19-main 2.12.5-r0 None fixed
apk-tools 3.18-main 2.12.5-r0 None fixed
apk-tools 3.17-main 2.12.5-r0 None fixed
apk-tools 3.12-main 2.10.6-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
apk-tools 3.11-main 2.10.6-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
apk-tools 3.10-main 2.10.6-r0 Natanael Copa <ncopa@alpinelinux.org> fixed