[From nobody Mon Aug 3 19:03:06 2026 Received: (at submit) by bugs.debian.org; 4 Jun 2026 20:00:54 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-119.6 required=4.0 tests=ALL_TRUSTED,BAYES_00, BODY_INCLUDES_PACKAGE,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,FROMDEVELOPER,HAS_PACKAGE,MD5_SHA1_SUM, SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 150; neutral, 51; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <ntyni@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:49482) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <ntyni@debian.org>) id 1wVEFK-00GQ7V-2n for submit@bugs.debian.org; Thu, 04 Jun 2026 20:00:54 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=5Kvsr7aoYXh2l/8kaOc7GNGnwGI36MeZTpLq0nXAlrw=; b=Ad74hvcGTGnqAJYlT+QtqiILkH XwUKA1cAcLqVyakx7JAdRRP9V85rbibnCBWkVWOlqxeiTMB3E/G16yGx9nNIaW3FZcErt4egWQVmR wO7Ess34TK90+01wdCesMTUpW51vWAsA/OpTdg36FW0aKcxrKiwFoUHPT8FqLOu3WpEAQJvdGklz3 lRKnp7Ns6wWQIvL7WCW5l+Jx3HH9VeJ6BOYLCbXiiYU+5k4I2sLeTR7Lm/+QowG31fqNAwiB2buyj Hzf2ADV991rRxD9xXmKlRHl6dUuws5k0mZ2dUxQDZuFlpPLnYkWFFw9fiORf2+7+EAb2Mi35lFZmv z2T4OEtA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <ntyni@debian.org>) id 1wVEFI-004l7g-17 for submit@bugs.debian.org; Thu, 04 Jun 2026 20:00:53 +0000 Date: Thu, 4 Jun 2026 23:00:50 +0300 From: Niko Tyni <ntyni@debian.org> To: submit@bugs.debian.org Subject: Archive-Tar: CVE-2026-42496 Message-ID: <aiHZciamCYscirpP@app-dd> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: ntyni Delivered-To: submit@bugs.debian.org Package: perl Version: 5.40.1-6 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org Forwarded: https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158 Control: found -1 5.32.1-4 Control: found -1 5.36.0-1 Control: found -1 5.42.2-1 The following vulnerability was published[0] for Archive-Tar (bundled with perl): CVE ID: CVE-2026-42496 Distribution: Archive-Tar Versions: before 3.08 MetaCPAN: https://metacpan.org/dist/Archive-Tar VCS Repo: https://github.com/jib/archive-tar-new Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory Description ----------- Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path. [0] https://lists.security.metacpan.org/cve-announce/msg/40396459/ -- Niko Tyni ntyni@debian.org ]