Описание
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps-legacy/xenial | needs-triage | |
| esm-apps/bionic | needs-triage | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | needs-triage | |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| jammy | needs-triage | |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needs-triage | |
| esm-apps/resolute | needs-triage | |
| jammy | DNE | |
| noble | DNE | |
| questing | ignored | end of life, was needs-triage |
| resolute | needs-triage | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/noble | needs-triage | |
| jammy | DNE | |
| noble | needs-triage | |
| questing | ignored | end of life, was needs-triage |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 0.10.11-1ubuntu2 |
| esm-apps/noble | needs-triage | |
| esm-apps/resolute | not-affected | 0.10.11-1ubuntu2 |
| jammy | DNE | |
| noble | needs-triage | |
| questing | released | 0.10.11-1ubuntu1.1 |
| resolute | not-affected | 0.10.11-1ubuntu2 |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 0.4.45-1 |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | released | 0.4.37-3ubuntu0.1 |
| esm-apps/noble | released | 0.4.40-1ubuntu0.1 |
| esm-apps/resolute | not-affected | 0.4.45-1 |
| jammy | released | 0.4.37-3ubuntu0.1 |
| noble | released | 0.4.40-1ubuntu0.1 |
| questing | released | 0.4.43-4ubuntu0.1 |
| resolute | not-affected | 0.4.45-1 |
| upstream | released | 0.4.45 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps-legacy/xenial | needs-triage | |
| esm-apps/bionic | needs-triage | |
| esm-apps/focal | needs-triage | |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| esm-infra-legacy/trusty | needs-triage | |
| jammy | released | 1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1 |
| noble | released | 1.75.0+dfsg0ubuntu1-0ubuntu7.4 |
| questing | DNE | |
| resolute | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/jammy | released | 1.62.1+dfsg1-1ubuntu0.22.04.3 |
| jammy | released | 1.62.1+dfsg1-1ubuntu0.22.04.3 |
| noble | DNE | |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/noble | released | 1.74.1+dfsg0ubuntu1-0ubuntu15 |
| jammy | DNE | |
| noble | released | 1.74.1+dfsg0ubuntu1-0ubuntu15 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | released | 1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1 |
| esm-apps/noble | released | 1.76.0+dfsg0ubuntu1-0ubuntu0.24.04.2 |
| jammy | released | 1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1 |
| noble | released | 1.76.0+dfsg0ubuntu1-0ubuntu0.24.04.2 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | released | 1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 |
| esm-apps/noble | released | 1.77.2+dfsg1ubuntu1-0ubuntu0.24.04.1 |
| jammy | released | 1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 |
| noble | released | 1.77.2+dfsg1ubuntu1-0ubuntu0.24.04.1 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | released | 1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 |
| esm-apps/noble | released | 1.78.0+dfsg1ubuntu1-0ubuntu0.24.04.2 |
| jammy | released | 1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 |
| noble | released | 1.78.0+dfsg1ubuntu1-0ubuntu0.24.04.2 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | released | 1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 |
| esm-apps/noble | released | 1.79.0+dfsg1ubuntu1-0ubuntu0.24.04.1 |
| jammy | released | 1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1 |
| noble | released | 1.79.0+dfsg1ubuntu1-0ubuntu0.24.04.1 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | released | 1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1 |
| esm-apps/noble | released | 1.80.1+dfsg0ubuntu1-0ubuntu0.24.04.01 |
| jammy | released | 1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1 |
| noble | released | 1.80.1+dfsg0ubuntu1-0ubuntu0.24.04.01 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/jammy | released | 1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1 |
| esm-apps/noble | released | 1.81.0+dfsg0ubuntu1-0ubuntu0.24.04.1 |
| jammy | released | 1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1 |
| noble | released | 1.81.0+dfsg0ubuntu1-0ubuntu0.24.04.1 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/jammy | released | 1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04.1 |
| esm-apps/noble | released | 1.82.0+dfsg0ubuntu0-0ubuntu0.24.04.1 |
| jammy | released | 1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04.1 |
| noble | released | 1.82.0+dfsg0ubuntu0-0ubuntu0.24.04.1 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| jammy | released | 1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04.1 |
| noble | released | 1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04.1 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| jammy | released | 1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04.1 |
| noble | released | 1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04.1 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| jammy | released | 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04.1 |
| noble | released | 1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2 |
| questing | released | 1.85.1+dfsg0ubuntu2-0ubuntu1.25.04.1 |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| jammy | DNE | |
| noble | DNE | |
| questing | released | 1.88.0+dfsg0ubuntu1-0ubuntu2 |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| jammy | released | 1.89.0+dfsg~24.04-0ubuntu0.22.04.2 |
| noble | released | 1.89.0+dfsg~24.04-0ubuntu0.24.04.2 |
| questing | DNE | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.91.1+dfsg-0ubuntu2 |
| esm-apps/resolute | not-affected | 1.91.1+dfsg-0ubuntu2 |
| jammy | released | 1.91.1+dfsg~22.04-0ubuntu0.22.04.3 |
| noble | released | 1.91.1+dfsg~24.04-0ubuntu0.24.04.2 |
| questing | not-affected | 1.91.1+dfsg-0ubuntu3~25.10.1 |
| resolute | not-affected | 1.91.1+dfsg-0ubuntu2 |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.92.0+dfsg-0ubuntu2 |
| esm-apps/resolute | not-affected | 1.92.0+dfsg-0ubuntu2 |
| jammy | DNE | |
| noble | DNE | |
| questing | DNE | |
| resolute | not-affected | 1.92.0+dfsg-0ubuntu2 |
| upstream | needs-triage |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.93.1+dfsg-0ubuntu5 |
| jammy | DNE | |
| noble | DNE | |
| questing | DNE | |
| resolute | not-affected | 1.93.1+dfsg-0ubuntu5 |
| upstream | needs-triage |
Показывать по
Ссылки на источники
6.5 Medium
CVSS3
Связанные уязвимости
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
tar-rs: unpack_in can chmod arbitrary directories by following symlinks
tar-rs is a tar archive reading/writing library for Rust. In versions ...
tar-rs `unpack_in` can chmod arbitrary directories by following symlinks
6.5 Medium
CVSS3