tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade chromium-rustUpgrade rust | Mar 25, 2026 | Mar 20, 2026 |
| Amazon Linux Ami 2 | — | Upgrade rust-gdbUpgrade rust-std-staticUpgrade rust-debugger-commonUpgrade rust-toolsetUpgrade rust-analyzerUpgrade rust-srcUpgrade rust-toolset-srpm-macrosUpgrade rustfmtUpgrade rust-docUpgrade clippyUpgrade rustUpgrade cargo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade rust-analyzerUpgrade rustfmtUpgrade rust-std-static-wasm32-wasip1Upgrade clamav1.5-docUpgrade rust-docUpgrade clamav1.5-debuginfoUpgrade rust-std-static-wasm32-unknown-unknownUpgrade rust-srcUpgrade cargoUpgrade rust-below-debugsourceUpgrade rust-toolsetUpgrade rust-cargo-c-debugsourceUpgrade rust-analyzer-debuginfoUpgrade clamav1.5-filesystemUpgrade rustfmt-debuginfoUpgrade clamav1.5-libUpgrade rust-gdbUpgrade rust-debugsourceUpgrade rust-lldbUpgrade clamav1.5Upgrade clamd1.5-debuginfoUpgrade clamav1.5-dataUpgrade clamav1.5-freshclamUpgrade clamav1.5-lib-debuginfoUpgrade clamav1.5-freshclam-debuginfoUpgrade rust-debugger-commonUpgrade rustUpgrade clamav1.5-debugsourceUpgrade below-debuginfoUpgrade rust-std-staticUpgrade cargo-debuginfoUpgrade clamav1.5-milter-debuginfoUpgrade clamav1.5-develUpgrade rust-toolset-srpm-macrosUpgrade belowUpgrade rust-debuginfoUpgrade clamd1.5Upgrade clippy-debuginfoUpgrade cargo-c-debuginfoUpgrade cargo-cUpgrade clamav1.5-milterUpgrade clippy | Apr 14, 2026 | Mar 20, 2026 |
| Debian | — | Upgrade rustc | Sep 21, 2026 | Mar 20, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Mar 20, 2026 |
| Ubuntu | — | Upgrade rustc-1.79Upgrade librust-cargo-c-devUpgrade rustc-1.62Upgrade rustc-1.85Upgrade rustc-1.88Upgrade rustc-1.81Upgrade rustcUpgrade librust-tar-devUpgrade rustc-1.91Upgrade rustc-1.83Upgrade rustc-1.84Upgrade librust-tar+default-devUpgrade rustc-1.76Upgrade rustc-1.78Upgrade cargo-cUpgrade rustc-1.89Upgrade rustc-1.80Upgrade rustc-1.74Upgrade rustc-1.82Upgrade rustc-1.77 | Apr 2, 2026 | Mar 20, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub