astral-tokio-tar (crates.io)
Advisories
11
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.6.2 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p astral-tokio-tar --precise 0.6.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-3cv2-h65g-fgmm astral-tokio-tar has a PAX Header Desynchronization issue |
Medium | < 0.6.2 | 0.6.2 |
| GHSA-3cv2-h65g-fgmm astral-tokio-tar has a PAX Header Desynchronization issue |
Medium | >= 0.0.0-0, < 0.6.2 | 0.6.2 |
| GHSA-fp55-jw48-c537 astral-tokio-tar is Vulnerable to PAX Header Desynchronization |
Medium | >= 0.0.0-0, < 0.6.1 | 0.6.1 |
| GHSA-xx64-wwv2-hcqq astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks |
Low | < 0.6.1 | 0.6.1 |
| GHSA-xx64-wwv2-hcqq astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks |
Low | >= 0.0.0-0, < 0.6.1 | 0.6.1 |
| GHSA-fp55-jw48-c537 astral-tokio-tar is Vulnerable to PAX Header Desynchronization |
Medium | < 0.6.1 | 0.6.1 |
| GHSA-6gx3-4362-rf54 astral-tokio-tar insufficiently validates PAX extensions during extraction |
Medium EPSS 0.25% |
< 0.6.0 | 0.6.0 |
| GHSA-6gx3-4362-rf54 astral-tokio-tar insufficiently validates PAX extensions during extraction |
Medium EPSS 0.25% |
>= 0.0.0-0, < 0.6.0 | 0.6.0 |
| GHSA-j5gw-2vrg-8fgx astral-tokio-tar Vulnerable to PAX Header Desynchronization |
High EPSS 0.70% |
< 0.5.6 | 0.5.6 |
| GHSA-j5gw-2vrg-8fgx astral-tokio-tar Vulnerable to PAX Header Desynchronization |
High EPSS 0.70% |
>= 0.0.0-0, < 0.5.6 | 0.5.6 |
| GHSA-3wgq-wrwc-vqmv astral-tokio-tar has a path traversal in tar extraction |
Medium EPSS 0.22% |
< 0.5.4 | 0.5.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor