Description
A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by crafting a malicious APKINDEX.tar.gz file with a bad pax header block.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.13 | apk-tools | 2.7.2-r0 | — |
| Alpine v3.12 | apk-tools | 2.7.2-r0 | — |
| Alpine v3.11 | apk-tools | 2.7.2-r0 | — |
| Alpine v3.10 | apk-tools | 2.7.2-r0 | — |