CVE-2022-48303

Name of the Vulnerable Software and Affected Versions GNU Tar versions 1.34 and earlier

Description The issue is related to a one-byte out-of-bounds read in the from header function in list.c that results in the use of uninitialized memory for a conditional jump. This occurs via a V7 archive in which mtime has approximately 11 whitespace characters. Exploitation to change the flow of control has not been demonstrated.

Recommendations For GNU Tar versions 1.34 and earlier, consider updating to a version that fixes this issue. As a temporary workaround, restrict the use of V7 archives with mtime containing approximately 11 whitespace characters to minimize the risk of exploitation. Avoid using the from header function in list.c until a patch is available.