critical
CVE-2021-33643
libtar: out-of-bounds read in gnu_longlink
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, Azure Linux, CBL-Mariner, Photon OS. Rated lower by Red Hat (medium), AlmaLinux (medium), Oracle (medium), Rocky Linux (medium), Ubuntu (medium).
Description
An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longlink, causing an out-of-bounds read.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | libtar | 0:1.2.20-11.azl3 |
| CBL-Mariner 1.0 | libtar | 0:1.2.20-10.cm1 |
| CBL-Mariner 2.0 | libtar | 0:1.2.20-10.cm2 |
| Photon OS 2.0 | libtar | 1.2.20-6.ph2 |
| Photon OS 3.0 | libtar | 1.2.20-6.ph3 |
| Photon OS 4.0 | libtar, libtar-devel | 1.2.20-6.ph4 |
| Photon OS 5.0 | libtar, libtar-devel | 1.2.20-7.ph5 |
| alma 8 | libtar | 1.2.20-17.el8 |
| debian 11 | libtar | 1.2.20-8+deb12u1~deb11u1 |
| debian 12 | libtar | 1.2.20-8+deb12u1 |
| echo | libtar | 1.2.20-8+deb12u1 |
| Oracle Linux 8 | libtar | 1.2.20-17.el8 |
Show all 26 entries from 22 sources
| Source | Package | Fixed in |
|---|---|---|
| Azure Linux 3.0 | libtar | 0:1.2.20-11.azl3 |
| CBL-Mariner 1.0 | libtar | 0:1.2.20-10.cm1 |
| CBL-Mariner 2.0 | libtar | 0:1.2.20-10.cm2 |
| Photon OS 2.0 | libtar | 1.2.20-6.ph2 |
| Photon OS 3.0 | libtar | 1.2.20-6.ph3 |
| Photon OS 4.0 | libtar | 1.2.20-6.ph4 |
| Photon OS 4.0 | libtar-devel | 1.2.20-6.ph4 |
| Photon OS 5.0 | libtar | 1.2.20-7.ph5 |
| Photon OS 5.0 | libtar-devel | 1.2.20-7.ph5 |
| alma 8 | libtar | 1.2.20-17.el8 |
| debian 11 | libtar | 1.2.20-8+deb12u1~deb11u1 |
| debian 12 | libtar | 1.2.20-8+deb12u1 |
| echo | libtar | 1.2.20-8+deb12u1 |
| Oracle Linux 8 | libtar | 1.2.20-17.el8 |
| Red Hat | libtar | no fix listed |
| Red Hat | libtar-devel | no fix listed |
| rocky 8 | libtar | 1.2.20-17.el8 |
| seal Red Hat 7 | libtar | 1.2.11-29.el7+sp999 |
| seal Red Hat 7 | seal-libtar | 1.2.11-29.el7+sp999 |
| ubuntu 16.04-ESM | libtar | 1.2.20-4ubuntu0.1~esm1 |
| ubuntu 18.04-ESM | libtar | 1.2.20-7ubuntu0.1~esm1 |
| ubuntu 20.04 | libtar | 1.2.20-8ubuntu0.20.04.1 |
| ubuntu 20.04-ESM | libtar | 1.2.20-8ubuntu0.20.04.1 |
| ubuntu 22.04 | libtar | 1.2.20-8ubuntu0.22.04.1 |
| ubuntu 24.04 | libtar | 1.2.20-8.1ubuntu0.24.04.1 |
| ubuntu 24.10 | libtar | 1.2.20-8.1ubuntu0.24.10.1 |
References
- https://access.redhat.com/errata/RHSA-2023:2898
- https://access.redhat.com/security/cve/CVE-2021-33643
- https://bugzilla.redhat.com/2121289
- https://bugzilla.redhat.com/2121292
- https://bugzilla.redhat.com/2121295
- https://bugzilla.redhat.com/2121297
- https://bugzilla.redhat.com/show_bug.cgi?id=2121289
- https://bugzilla.redhat.com/show_bug.cgi?id=2121292
All 29 references
- https://bugzilla.redhat.com/show_bug.cgi?id=2121295
- https://bugzilla.redhat.com/show_bug.cgi?id=2121297
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33643
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33644
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33645
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33646
- https://errata.almalinux.org/8/ALSA-2023-2898.html
- https://errata.rockylinux.org/RLSA-2023:2898
- https://linux.oracle.com/cve/CVE-2021-33643.html
- https://linux.oracle.com/errata/ELSA-2023-2898.html
- https://lists.debian.org/debian-lts-announce/2025/01/msg00026.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5YSHZY753R7XW6CIKJVAWI373WW3YRRJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OD4HEBSTI22FNYKOKK7W3X6ZQE6FV3XC/
- https://nvd.nist.gov/vuln/detail/CVE-2021-33643
- https://ubuntu.com/security/notices/USN-7398-1
- https://www.cve.org/CVERecord?id=CVE-2021-33643
- https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1807