bug#47422: tar is vulnerable to CVE-2021-20193

[Leo Famulari]

On Fri, Nov 05, 2021 at 05:14:13AM +0000, phodina via Bug reports for GNU Guix 
wrote:
> here's patch for the master branch as I'm not sure what is the roadmap for 
> merging core-updates into master.
> 
> The obvious downside is that the update triggers large rebuild of core 
> packages :-/

Right, it's not feasible to apply this patch on the master branch, for
that reason. And, it would not only require rebuilding core packages,
but every single package, if I understand correctly.

For Guix's internal use of tar, it seems that CVE-2021-20193 [0] is not
a problem:

"This flaw allows an attacker who can submit a crafted input file to tar
to cause uncontrolled consumption of memory. The highest threat from
this vulnerability is to system availability."

When tar is used by Guix to unpack an upstream tarball, a Guix developer
has already tested that it's possible to unpack the tarball without
making the system unavailable. And Guix checks the source hash before
unpacking the tarball. Does this evaluation seem correct?

For use of tar by Guix users, we could add a new package 'tar-1.34' and
arrange so that `guix install tar` selects it instead of tar@1.32, and
so that whatever tar is provided by default on Guix System [1] is
tar-1.34. And we would also take care to properly undo this workaround
on the core-updates branch.

[0] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20193
[1] I *think* that is handled by ((gnu system) %base-packages-utils)