CVE-2021-20193: gnu tar
CVSS: 4.3v2.0MediumModified
AliasesALPINE-CVE-2021-20193MGASA-2021-0233SUSE-SU-2021:0974-1SUSE-SU-2021:0975-1UBUNTU-CVE-2021-20193USN-5329-1DEBIAN-CVE-2021-20193openSUSE-SU-2021:0494-1openSUSE-SU-2024:11620-1
Published 26-03-2021Last modified 14-10-2026
Vulnerability summary
CVE-2021-20193 is a medium (CVSS 4.3) vulnerability in gnu tar. EPSS estimates a 1.09% chance of exploitation in the next 30 days, higher than 64.7% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v2.0 (NVD)EPSS score
1.09%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 26-03-2021PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.
CVSS metrics
5 scores · 4 sources · 2 versionsLow 3.3Preferred score · OSV · Alpine (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
1.09%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.09% on 19-09-2026
19-09-202619-10-2026
EPSS score1.09%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
- CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
Affected systems
Suse4 products
- tar&distro=SUSE Linux Enterprise Micro 5.0< 1.30-3.6.1
- tar&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.30-3.6.1
- tar&distro=SUSE Linux Enterprise Server 12 SP5< 1.27.1-15.9.1
- tar&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.27.1-15.9.1
Mageia2 products
- tar< 1.32-1.1.mga7
- tar< 1.33-2.1.mga8
Opensuse2 products
- tar&distro=openSUSE Leap 15.2< 1.30-lp152.4.3.1
- tar&distro=openSUSE Tumbleweed< 1.34-5.1
Alpine1 product
- tar< 1.32-r1 | < 1.32-r2 | < 1.34-r0
Debian1 product
- tar< 1.34+dfsg-1
Gnu1 product
- tar≤ 1.33
Ubuntu1 product
- tar< 1.34+dfsg-1build1 | < 1.27.1-1ubuntu0.1+esm2 | < 1.28-2.1ubuntu0.2+esm1 | < 1.29b-2ubuntu0.3 | < 1.30+dfsg-7ubuntu0.20.04.2
7 vendors · 12 products
References
17 links- git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777X Refsource MISCMailing ListPatchThird Party Advisory
