CVE-2020-12265, There is no fixed version for decompress-tar, how to prove there is no issure for decompress-4.2.1?

[waltbest2]

There is no fixed version for decompress-tar, and how to prove there is no issure for decompress-4.2.1?

[MikeNitsenko]

@waltbest2 did you find a solution for this?
Thanks!

[jeremymeng]

any updates/recommendations?

[efojs]

AWS Inspector reports that decompress-tar is vulnerable (linking to https://nvd.nist.gov/vuln/detail/CVE-2020-12265) — was/is the issue in decompress or in decompress-tar?

upd:
looks like in compress (according to fix), so decompress-tar looks false-positive

[efojs]

There is no fixed version for decompress-tar

decompress-tar is decompress' dependency, it extracts files, but issue was in paths :

package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system,

(source)

---

how to prove there is no issure for decompress-4.2.1

There are tests in the PR with fix, didn't dive into them, but checking tests can be the way to start.