[From nobody Mon Aug 3 19:03:09 2026 Received: (at submit) by bugs.debian.org; 4 Jun 2026 19:58:16 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-119.6 required=4.0 tests=ALL_TRUSTED,BAYES_00, BODY_INCLUDES_PACKAGE,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_VALID_EF,FROMDEVELOPER,HAS_PACKAGE,MD5_SHA1_SUM, SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 24; hammy, 150; neutral, 51; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <ntyni@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:55202) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <ntyni@debian.org>) id 1wVECm-00GPk3-2O for submit@bugs.debian.org; Thu, 04 Jun 2026 19:58:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=0t39wjVn7Wi+yhT2TsNbbnqiHK1GOBdvgVVQOlJvG0Q=; b=oL4jzZOQ3aVPjKNas3AQnF1dfl VsYQkkFxPvBrxyrCi/vGloHp306AH8VgwNe2l5nmXTjU7EnoLbee1G5GrDcFr98zmwer9a4b1sRug IjIGG073ro5c1jL+fIN+wnBT3UJwyFD0Z2UjZZaQg5sbBW/6e5xcydtMLmW6CvIjHlXXZxUN8ty8l 0R1aGdSBpcgWmQKGajY+cVtQZ83aFnjeZ/dzVtEluMlfLKh1bG2hIqZHZxPKr3ozEaK+walq2H2h4 XqY+ze8Vx7w5wuCUJ1CS3nZEc1oO7iFjOGNkhJ+wN3l46cGgbeeIRJqSdUrq1rN48uc+Ks8+rZFKl UJAS36Lg==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <ntyni@debian.org>) id 1wVECk-004kzZ-1y for submit@bugs.debian.org; Thu, 04 Jun 2026 19:58:15 +0000 Date: Thu, 4 Jun 2026 22:58:13 +0300 From: Niko Tyni <ntyni@debian.org> To: submit@bugs.debian.org Subject: Archive-Tar: CVE-2026-42497 Message-ID: <aiHY1WCgujmZbqCT@app-dd> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: ntyni Delivered-To: submit@bugs.debian.org Package: perl Version: 5.40.1-6 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org Forwarded: https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158 Control: found -1 5.32.1-4 Control: found -1 5.36.0-1 Control: found -1 5.42.2-1 The following vulnerability was published[0] for Archive-Tar (bundled with perl): CVE ID: CVE-2026-42497 Distribution: Archive-Tar Versions: before 3.08 MetaCPAN: https://metacpan.org/dist/Archive-Tar VCS Repo: https://github.com/jib/archive-tar-new Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory Description ----------- Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode. A subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone. [0] https://lists.security.metacpan.org/cve-announce/msg/40396457/ -- Niko Tyni ntyni@debian.org ]