VDB
RHSA-2025%3A3932
RHSA-2025%3A3932
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the tar-fs package for Node.js. In affected versions, unauthorized file writes or overwrites outside the intended extraction directory can occur when extracting a maliciously crafted tar file. The issue is associated with index.js in the tar-fs package.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | devspaces/configbump-rhel9@sha256:3ece40e4a3862dc29d9bb41f407117fc52db2ca8208a1dabe82eea28e7a9ba29_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/configbump-rhel9@sha256:3ece40e4a3862dc29d9bb41f407117fc52db2ca8208a1dabe82eea28e7a9ba29_ppc64le, devspaces/configbump-rhel9@sha256:3ece40e4a3862dc29d9bb41f407117fc52db2ca8208a1dabe82eea28e7a9ba29_ppc64le, * |
| Red Hat | devspaces/devspaces-operator-bundle@sha256:1bf0e4367621ed8fef30b5fbd6fbffa59731ecb20cbb8c9772015f8958198a16_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/devspaces-operator-bundle@sha256:1bf0e4367621ed8fef30b5fbd6fbffa59731ecb20cbb8c9772015f8958198a16_ppc64le, devspaces/devspaces-operator-bundle@sha256:1bf0e4367621ed8fef30b5fbd6fbffa59731ecb20cbb8c9772015f8958198a16_ppc64le, devspaces/devspaces-operator-bundle@sha256:1bf0e4367621ed8fef30b5fbd6fbffa59731ecb20cbb8c9772015f8958198a16_ppc64le |
| Red Hat | devspaces/imagepuller-rhel9@sha256:6987db3152cec7edcf50dbe86d50a5dcdb4923b0879212711b062718a1e4b162_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/imagepuller-rhel9@sha256:6987db3152cec7edcf50dbe86d50a5dcdb4923b0879212711b062718a1e4b162_amd64, devspaces/imagepuller-rhel9@sha256:6987db3152cec7edcf50dbe86d50a5dcdb4923b0879212711b062718a1e4b162_amd64, * |
| Red Hat | devspaces/code-rhel9@sha256:e0ddb90fb05f486b80fe1c0e7222bc6dd90071f762ab8fd8cfc45a39faa020b0_s390x as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/code-rhel9@sha256:e0ddb90fb05f486b80fe1c0e7222bc6dd90071f762ab8fd8cfc45a39faa020b0_s390x, devspaces/code-rhel9@sha256:e0ddb90fb05f486b80fe1c0e7222bc6dd90071f762ab8fd8cfc45a39faa020b0_s390x |
| Red Hat | devspaces/dashboard-rhel9@sha256:f99e4373e39a70c99f4c67cd1a10483c99310e478e5a8b840ab114d11ed2ebd3_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/dashboard-rhel9@sha256:f99e4373e39a70c99f4c67cd1a10483c99310e478e5a8b840ab114d11ed2ebd3_ppc64le, devspaces/dashboard-rhel9@sha256:f99e4373e39a70c99f4c67cd1a10483c99310e478e5a8b840ab114d11ed2ebd3_ppc64le, devspaces/dashboard-rhel9@sha256:f99e4373e39a70c99f4c67cd1a10483c99310e478e5a8b840ab114d11ed2ebd3_ppc64le |
| Red Hat | devspaces/code-rhel9@sha256:e10c4f241fb1dfa9437e453b65ed57ca79550e487f16bc6742d6c1359824dcc0_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/code-rhel9@sha256:e10c4f241fb1dfa9437e453b65ed57ca79550e487f16bc6742d6c1359824dcc0_ppc64le, devspaces/code-rhel9@sha256:e10c4f241fb1dfa9437e453b65ed57ca79550e487f16bc6742d6c1359824dcc0_ppc64le |
| Red Hat | devspaces/machineexec-rhel9@sha256:ea043fb015e82632de477f17a94e0b9dd31b34312c0214fd2b8128e0d71ba716_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/machineexec-rhel9@sha256:ea043fb015e82632de477f17a94e0b9dd31b34312c0214fd2b8128e0d71ba716_ppc64le, devspaces/machineexec-rhel9@sha256:ea043fb015e82632de477f17a94e0b9dd31b34312c0214fd2b8128e0d71ba716_ppc64le |
| Red Hat | devspaces/traefik-rhel9@sha256:01e231b75154957ecf5fa3f0d201f648d8558c6cfd7294a49865ff857316ee89_s390x as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/traefik-rhel9@sha256:01e231b75154957ecf5fa3f0d201f648d8558c6cfd7294a49865ff857316ee89_s390x, devspaces/traefik-rhel9@sha256:01e231b75154957ecf5fa3f0d201f648d8558c6cfd7294a49865ff857316ee89_s390x |
| Red Hat | devspaces-tech-preview/jetbrains-ide-rhel9@sha256:13e0884bb5ae5129350025beea1cbd2a6fdd9087718f6e085738a048629519b9_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces-tech-preview/jetbrains-ide-rhel9@sha256:13e0884bb5ae5129350025beea1cbd2a6fdd9087718f6e085738a048629519b9_amd64, devspaces-tech-preview/jetbrains-ide-rhel9@sha256:13e0884bb5ae5129350025beea1cbd2a6fdd9087718f6e085738a048629519b9_amd64 |
| Red Hat | devspaces/devspaces-operator-bundle@sha256:091d2d34fbd525a7e9b2c4b1b8eef5283039dfcaac597bece9f4ad0236d1cbf9_s390x as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/devspaces-operator-bundle@sha256:091d2d34fbd525a7e9b2c4b1b8eef5283039dfcaac597bece9f4ad0236d1cbf9_s390x, devspaces/devspaces-operator-bundle@sha256:091d2d34fbd525a7e9b2c4b1b8eef5283039dfcaac597bece9f4ad0236d1cbf9_s390x |
| Red Hat | devspaces/imagepuller-rhel9@sha256:01217396dfa1ffa44e9cf6b384093a7b6946135fd8fa122083ac6062a3790a2d_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/imagepuller-rhel9@sha256:01217396dfa1ffa44e9cf6b384093a7b6946135fd8fa122083ac6062a3790a2d_ppc64le, devspaces/imagepuller-rhel9@sha256:01217396dfa1ffa44e9cf6b384093a7b6946135fd8fa122083ac6062a3790a2d_ppc64le, devspaces/imagepuller-rhel9@sha256:01217396dfa1ffa44e9cf6b384093a7b6946135fd8fa122083ac6062a3790a2d_ppc64le |
| Red Hat | devspaces/pluginregistry-rhel9@sha256:f9d32726831f630601ad041898282bb5eaa50e81d6f8aeae6cf4a6fe272c37a6_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/pluginregistry-rhel9@sha256:f9d32726831f630601ad041898282bb5eaa50e81d6f8aeae6cf4a6fe272c37a6_ppc64le, devspaces/pluginregistry-rhel9@sha256:f9d32726831f630601ad041898282bb5eaa50e81d6f8aeae6cf4a6fe272c37a6_ppc64le, devspaces/pluginregistry-rhel9@sha256:f9d32726831f630601ad041898282bb5eaa50e81d6f8aeae6cf4a6fe272c37a6_ppc64le |
| Red Hat | devspaces/pluginregistry-rhel9@sha256:fdd3cdce6f5d0308b19f84dbe31b746c3400c67b675a173e8062dfa593290e51_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/pluginregistry-rhel9@sha256:fdd3cdce6f5d0308b19f84dbe31b746c3400c67b675a173e8062dfa593290e51_amd64, devspaces/pluginregistry-rhel9@sha256:fdd3cdce6f5d0308b19f84dbe31b746c3400c67b675a173e8062dfa593290e51_amd64 |
| Red Hat | devspaces/imagepuller-rhel9@sha256:ef04c7de41b9b0f5b53d7a8ac39121c509070a6023d75c1cf8f32301ab356567_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/imagepuller-rhel9@sha256:ef04c7de41b9b0f5b53d7a8ac39121c509070a6023d75c1cf8f32301ab356567_s390x, *, * |
| Red Hat | devspaces/devspaces-rhel9-operator@sha256:c3ad009df338a94aed8ca3d4d069bee447ce8b64291bc702fcfa408429108a80_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, *, devspaces/devspaces-rhel9-operator@sha256:c3ad009df338a94aed8ca3d4d069bee447ce8b64291bc702fcfa408429108a80_amd64 |
| Red Hat | devspaces/code-rhel9@sha256:d956ac914d55184d56a5f5dee491254f5267c0fbc984a1171429e3a234872a84_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/code-rhel9@sha256:d956ac914d55184d56a5f5dee491254f5267c0fbc984a1171429e3a234872a84_amd64, devspaces/code-rhel9@sha256:d956ac914d55184d56a5f5dee491254f5267c0fbc984a1171429e3a234872a84_amd64, devspaces/code-rhel9@sha256:d956ac914d55184d56a5f5dee491254f5267c0fbc984a1171429e3a234872a84_amd64 |
| Red Hat | devspaces/udi-rhel9@sha256:8d0dbdfa02c2f09576916271aeb0cfeeffc6554c02ee95035bf827de75809017_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/udi-rhel9@sha256:8d0dbdfa02c2f09576916271aeb0cfeeffc6554c02ee95035bf827de75809017_ppc64le, devspaces/udi-rhel9@sha256:8d0dbdfa02c2f09576916271aeb0cfeeffc6554c02ee95035bf827de75809017_ppc64le, devspaces/udi-rhel9@sha256:8d0dbdfa02c2f09576916271aeb0cfeeffc6554c02ee95035bf827de75809017_ppc64le |
| Red Hat | devspaces/imagepuller-rhel9@sha256:6987db3152cec7edcf50dbe86d50a5dcdb4923b0879212711b062718a1e4b162_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/imagepuller-rhel9@sha256:6987db3152cec7edcf50dbe86d50a5dcdb4923b0879212711b062718a1e4b162_amd64, devspaces/imagepuller-rhel9@sha256:6987db3152cec7edcf50dbe86d50a5dcdb4923b0879212711b062718a1e4b162_amd64, * |
| Red Hat | devspaces/udi-rhel9@sha256:a2bdfc8f71be04e61c6175ca533a4d759a69a297398319ddc751b5ffd9a4e3ef_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/udi-rhel9@sha256:a2bdfc8f71be04e61c6175ca533a4d759a69a297398319ddc751b5ffd9a4e3ef_amd64, devspaces/udi-rhel9@sha256:a2bdfc8f71be04e61c6175ca533a4d759a69a297398319ddc751b5ffd9a4e3ef_amd64 |
| Red Hat | devspaces/udi-base-rhel9@sha256:37984d3f5b7450fc01b101e1635430147b20ecf03b1e79abe6f6b350fa7be1c1_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/udi-base-rhel9@sha256:37984d3f5b7450fc01b101e1635430147b20ecf03b1e79abe6f6b350fa7be1c1_amd64, devspaces/udi-base-rhel9@sha256:37984d3f5b7450fc01b101e1635430147b20ecf03b1e79abe6f6b350fa7be1c1_amd64 |
…and 61 more
Timeline
- Apr 16, 2025 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jun 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:3932 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2348366 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2348367 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2355460 issue
- https://issues.redhat.com/browse/CRW-8327 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3932.json advisory
- https://access.redhat.com/security/cve/CVE-2024-12905 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-12905 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-12905 advisory
- https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed advisory
- https://access.redhat.com/security/cve/CVE-2025-22868 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22868 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22868 advisory
- https://go.dev/cl/652155 advisory
- https://go.dev/issue/71490 advisory
- https://pkg.go.dev/vuln/GO-2025-3488 advisory
- https://access.redhat.com/security/cve/CVE-2025-22869 advisory
- https://www.cve.org/CVERecord?id=CVE-2025-22869 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-22869 advisory
…and 3 more