CVE-2023-39804 Denial of service in n/a
An attacker can cause a denial of service by providing a crafted PAX archive with mishandled extension attributes to GNU tar.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-39804?
CVE-2023-39804 is a medium-severity denial of service vulnerability in n/a, published on 27 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.
Which versions are affected by CVE-2023-39804?
It affects 1 product.
Linux distribution packages (15)
tar SUSE:Linux Enterprise Micro 5.1 | All versions | 1.34-150000.3.34.1 |
tar SUSE:Linux Enterprise Micro 5.2 | All versions | 1.34-150000.3.34.1 |
tar SUSE:Linux Enterprise Micro 5.3 | All versions | 1.34-150000.3.34.1 |
tar SUSE:Linux Enterprise Micro 5.4 | All versions | 1.34-150000.3.34.1 |
tar SUSE:Linux Enterprise Micro 5.5 | All versions | 1.34-150000.3.34.1 |
tar SUSE:Linux Enterprise Micro 5.5 | All versions | 1.34-150000.3.34.1 |
tar SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 1.34-150000.3.34.1 |
tar SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.34-150000.3.34.1 |
tar SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.27.1-15.24.1 |
tar SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.27.1-15.24.1 |
tar openSUSE:Leap 15.4 | All versions | 1.34-150000.3.34.1 |
tar openSUSE:Leap 15.5 | All versions | 1.34-150000.3.34.1 |
tar openSUSE:Leap Micro 5.3 | All versions | 1.34-150000.3.34.1 |
tar openSUSE:Leap Micro 5.4 | All versions | 1.34-150000.3.34.1 |
tar openSUSE:Tumbleweed | All versions | 1.35-2.1 |
Products include Gnu Tar.
How do I fix CVE-2023-39804?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-39804 being exploited?
There is no known exploitation of CVE-2023-39804 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-52625, BELL-CVE-2023-39804, CLSA-2024-1706026767, CLSA-2024-1710436683, CLSA-2025-1762535960, CLSA-2025-1762536241 and 17 more.