Skip to content

[Aikido] Fix security issue in tar via minor version upgrade from 0.4.44 to 0.4.45#93

Open
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-20802693-7kpg
Open

[Aikido] Fix security issue in tar via minor version upgrade from 0.4.44 to 0.4.45#93
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/aikido-security-update-packages-20802693-7kpg

Conversation

@aikido-autofix
Copy link
Copy Markdown

Upgrade tar to fix PAX header size parsing (CVE-2026-33055) enabling symlink smuggling, and symlink-following chmod vulnerability (CVE-2026-33056).

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-33055
HIGH
[tar] A differential parsing vulnerability exists where the tar crate incorrectly skips PAX size headers when the base header size is nonzero, causing it to parse tar archives differently than other parsers and potentially allowing malicious symlinks to be smuggled into archives. This could enable attackers to bypass security checks on package registries like crates.io.
CVE-2026-33056
MEDIUM
[tar] The unpack_dir function follows symbolic links when checking if paths are directories, allowing a crafted tarball with a symlink followed by a directory entry to modify permissions of arbitrary directories outside the extraction root. This vulnerability enables arbitrary permission modification (chmod) on external directories through symlink dereferencing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants