tar (crates.io)
Advisories
9
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.4.46 or later clears every advisory below that has a fix.
Upgrade commands
cargo
cargo update -p tar --precise 0.4.46Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-3pv8-6f4r-ffg2 tar has a PAX header desynchronization issue |
Medium | < 0.4.46 | 0.4.46 |
| GHSA-j4xf-2g29-59ph tar-rs `unpack_in` can chmod arbitrary directories by following symlinks |
Medium EPSS 0.39% |
>= 0.0.0-0, < 0.4.45 | 0.4.45 |
| GHSA-gchp-q4r4-x4ff tar-rs incorrectly ignores PAX size headers if header size is nonzero |
High EPSS 0.41% |
< 0.4.45 | 0.4.45 |
| GHSA-gchp-q4r4-x4ff tar-rs incorrectly ignores PAX size headers if header size is nonzero |
High EPSS 0.41% |
>= 0.0.0-0, < 0.4.45 | 0.4.45 |
| GHSA-j4xf-2g29-59ph tar-rs `unpack_in` can chmod arbitrary directories by following symlinks |
Medium EPSS 0.39% |
< 0.4.45 | 0.4.45 |
| GHSA-62jx-8vmh-4mcw Links in archive can create arbitrary directories |
High EPSS 1.39% |
< 0.4.36 | 0.4.36 |
| GHSA-62jx-8vmh-4mcw Links in archive can create arbitrary directories |
High EPSS 1.39% |
>= 0.0.0-0, < 0.4.36 | 0.4.36 |
| GHSA-2367-c296-3mp2 Arbitrary file overwrite in tar-rs |
High EPSS 1.68% |
< 0.4.16 | 0.4.16 |
| GHSA-2367-c296-3mp2 Arbitrary file overwrite in tar-rs |
High EPSS 1.68% |
>= 0.0.0-0, < 0.4.16 | 0.4.16 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor