)]}'
{
  "commit": "d69c73211ac12e4435fa2cb68962db90353fc048",
  "tree": "cedb6ddaecc17444fdb9a70a1dbb0bd3c5b3179a",
  "parents": [
    "296750bf407ac633850075f709d56f798ff77bf6",
    "e4ed50d0d3cdaa0388f7e9e7651ceb287e7eee38"
  ],
  "author": {
    "name": "Jonathan Brouwer",
    "email": "jonathantbrouwer@gmail.com",
    "time": "Thu Jul 16 21:01:51 2026 +0200"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Thu Jul 16 21:01:51 2026 +0200"
  },
  "message": "Rollup merge of #159394 - renovate-bot:renovate/crate-tar-vulnerability, r\u003djieyouxu\n\nUpdate Rust crate tar to v0.4.46 [SECURITY]\n\nThis PR contains the following updates:\n\n| Package | Type | Update | Change |\n|---|---|---|---|\n| [tar](https://redirect.github.com/composefs/tar-rs) | dependencies | patch | `0.4.45` → `0.4.46` |\n\n---\n\n### tar has a PAX header desynchronization issue\n[GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2)\n\n\u003cdetails\u003e\n\u003csummary\u003eMore information\u003c/summary\u003e\n\n#### Details\n##### Summary\n\nWhen a tar stream contains multiple \"header\" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -\u003e L -\u003e file` (PAX, GNU longname, file) would result in `x`\u0027s extensions being applied to `L` rather than to `file`.\n\n[Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary entries. See the \"pax Header Block\" section for the specific prescription there.\n\nAs a result of this, an attacker can contrive a tar containing a sequence of tar headers such that tar-rs applies the PAX header\u0027s `size` extension to the next header in sequence, effectively desynchronizing the stream and enabling tar-rs specific skippage/extraction of members. In other words, a file can be contrived to extract differently on tar-rs than on other tar parsers.\n\n##### PoC\n\n[This tar](https://redirect.github.com/user-attachments/files/27141941/pax-overrides-extension-header.tar.zip) (zipped for size) demonstrates the desynchronization: with `tar tvf`:\n\n```\n% tar tvf tests/archives/pax-overrides-extension-header.tar\n----------  0 0      0        2048 Dec 31  1969 longname.txt\n----------  0 0      0           0 Dec 31  1969 file_b\n```\n\nwith `tar-rs`:\n\n```\n---- pax_size_does_not_apply_to_extension_headers stdout ----\n\nthread \u0027pax_size_does_not_apply_to_extension_headers\u0027 (250476889) panicked at tests/all.rs:2121:27:\ncalled `Result::unwrap()` on an `Err` value: Custom { kind: Other, error: \"numeric field was not a number: AAAAAAAA when getting cksum for AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\" }\nnote: run with `RUST_BACKTRACE\u003d1` environment variable to display a backtrace\n```\n\nIn the above case, the PoC is not weaponized, so it jumps into the middle of an entry and subsequently fails the checksum test rather than silently continuing with attacker-controlled archive state.\n\n##### Impact\n\nThis is very similar to GHSA-j5gw-2vrg-8fgx and GHSA-fp55-jw48-c537 in impact -- an attacker can use this to extract (or not extract) files from a tar stream depending on the tar parser used, which in turn can be used to obscure the presence of malicious files.\n\n#### Severity\nMedium\n\n#### References\n- [https://github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/composefs/tar-rs/security/advisories/GHSA-3pv8-6f4r-ffg2)\n- [https://github.com/composefs/tar-rs/pull/454](https://redirect.github.com/composefs/tar-rs/pull/454)\n- [https://github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838](https://redirect.github.com/composefs/tar-rs/commit/bab14dd84b411ac16ecb56d4f2d2f7bfb88a9838)\n- [https://github.com/composefs/tar-rs/releases/tag/0.4.46](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46)\n- [https://github.com/advisories/GHSA-3pv8-6f4r-ffg2](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2)\n\nThis data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-3pv8-6f4r-ffg2) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).\n\u003c/details\u003e\n\n---\n\n### Release Notes\n\n\u003cdetails\u003e\n\u003csummary\u003ecomposefs/tar-rs (tar)\u003c/summary\u003e\n\n### [`v0.4.46`](https://redirect.github.com/composefs/tar-rs/releases/tag/0.4.46)\n\n[Compare Source](https://redirect.github.com/composefs/tar-rs/compare/0.4.45...0.4.46)\n\n#### Security\n\n- archive: Fix another PAX header desync (GHSA-3cv2-h65g-fgmm) by [@\u0026#8203;cgwalters](https://redirect.github.com/cgwalters) in [#\u0026#8203;454](https://redirect.github.com/composefs/tar-rs/pull/454)\n\nSee also \u003chttps://github.com/astral-sh/tokio-tar/security/advisories/GHSA-3cv2-h65g-fgmm\u003e\n\n#### Other changes\n\n- ci: Fix and re-enable reverse dependency testing by [@\u0026#8203;cgwalters](https://redirect.github.com/cgwalters) in [#\u0026#8203;444](https://redirect.github.com/composefs/tar-rs/pull/444)\n- Update astral-tokio-tar requirement from 0.5 to 0.6 by [@\u0026#8203;dependabot](https://redirect.github.com/dependabot)\\[bot] in [#\u0026#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446)\n- Update some links by [@\u0026#8203;atouchet](https://redirect.github.com/atouchet) in [#\u0026#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445)\n- Add support of absolute paths by [@\u0026#8203;zxvfc](https://redirect.github.com/zxvfc) in [#\u0026#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426)\n- docs: Expand notes on concurrent mutations and following symlinks by [@\u0026#8203;cgwalters](https://redirect.github.com/cgwalters) in [#\u0026#8203;453](https://redirect.github.com/composefs/tar-rs/pull/453)\n- Update repo links by [@\u0026#8203;cgwalters](https://redirect.github.com/cgwalters) in [#\u0026#8203;451](https://redirect.github.com/composefs/tar-rs/pull/451)\n- ci: Add crates.io trusted publishing workflow by [@\u0026#8203;cgwalters](https://redirect.github.com/cgwalters) in [#\u0026#8203;456](https://redirect.github.com/composefs/tar-rs/pull/456)\n- Release 0.4.46 by [@\u0026#8203;cgwalters](https://redirect.github.com/cgwalters) in [#\u0026#8203;455](https://redirect.github.com/composefs/tar-rs/pull/455)\n\n#### New Contributors\n\n- [@\u0026#8203;dependabot](https://redirect.github.com/dependabot)\\[bot] made their first contribution in [#\u0026#8203;446](https://redirect.github.com/composefs/tar-rs/pull/446)\n- [@\u0026#8203;atouchet](https://redirect.github.com/atouchet) made their first contribution in [#\u0026#8203;445](https://redirect.github.com/composefs/tar-rs/pull/445)\n- [@\u0026#8203;zxvfc](https://redirect.github.com/zxvfc) made their first contribution in [#\u0026#8203;426](https://redirect.github.com/composefs/tar-rs/pull/426)\n\n**Full Changelog**: \u003chttps://github.com/composefs/tar-rs/compare/0.4.45...0.4.46\u003e\n\n\u003c/details\u003e\n\n---\n\n### Configuration\n\n📅 **Schedule**: (UTC)\n\n- Branch creation\n  - At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule defined)\n\n🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.\n\n♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.\n\n🔕 **Ignore**: Close this PR and you won\u0027t be reminded about this update again.\n\n---\n\n - [ ] \u003c!-- rebase-check --\u003eIf you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/rust-lang/rust).\n\u003c!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjUuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI2NS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--\u003e\n",
  "tree_diff": []
}