CVE-2021-32610: debian debian_linux Link Following
CVSS: 7.1v3.1HighModified
AliasesMGASA-2021-0393SUSE-SU-2022:3198-1UBUNTU-CVE-2021-32610USN-5027-1USN-5027-2DEBIAN-CVE-2021-32610DLA-2721-1SUSE-SU-2022:3198-2
Published 27-07-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-32610 is a high (CVSS 7.1) Link Following vulnerability in debian debian_linux. EPSS estimates a 73.38% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities.
CVSS score
7.1/10
010
High · v3.1 (NVD)EPSS score
73.38%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 27-07-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.1Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Low 3.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
73.38%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 73.38% on 20-09-2026
20-09-202620-10-2026
EPSS score73.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian3 products
- drupal7< 7.52-2+deb9u16
- php-pear< 1:1.10.13+submodules+notgz-1
- debian_linuxEOL9.0
Ubuntu2 products
- drupal7All versions (No fix recorded)
- php-pear< 1:1.10.5+submodules+notgz-1ubuntu1.18.04.4 | < 1:1.10.9+submodules+notgz-1ubuntu0.20.04.3 | < 1:1.10.1+submodules+notgz-6ubuntu0.3+esm1 | < 1:1.10.12+submodules+notgz+20210212-1ubuntu1
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Mageia1 product
- php-pear< 1.10.12-5.2.mga8
Opensuse1 product
- php8-pear&distro=openSUSE Leap 15.4< 1.10.21-150400.9.3.1
Php1 product
- archive_tar< 1.4.14
Suse1 product
- php8-pear&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP4< 1.10.21-150400.9.3.1
7 vendors · 10 products
References
20 links
lists.debian.org/debian-lts-announce/2021/07/msg00023.htmlMailing ListX Refsource MLISTThird Party Advisory- github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4fX Refsource MISCPatchThird Party Advisory
- github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755X Refsource MISCPatchThird Party Advisory