[From nobody Mon Mar 23 08:51:05 2026 Received: (at submit) by bugs.debian.org; 21 Mar 2026 18:44:42 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-10.9 required=4.0 tests=BAYES_00,FOURLA, FROMDEVELOPER,MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 22; hammy, 149; neutral, 46; spammy, 1. spammytokens:0.942-+--H*r:bugs.debian.org hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1w41JS-0088il-1e for submit@bugs.debian.org; Sat, 21 Mar 2026 18:44:42 +0000 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: rust-tar: CVE-2026-33056 Message-ID: <177411868159.2363632.14366388573678879513.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Sat, 21 Mar 2026 19:44:41 +0100 Delivered-To: submit@bugs.debian.org U291cmNlOiBydXN0LXRhcgpWZXJzaW9uOiAwLjQuNDQtMQpTZXZlcml0eTogaW1wb3J0YW50ClRh Z3M6IHNlY3VyaXR5IHVwc3RyZWFtClgtRGViYnVncy1DYzogY2FybmlsQGRlYmlhbi5vcmcsIERl YmlhbiBTZWN1cml0eSBUZWFtIDx0ZWFtQHNlY3VyaXR5LmRlYmlhbi5vcmc+CgpIaSwKClRoZSBm b2xsb3dpbmcgdnVsbmVyYWJpbGl0eSB3YXMgcHVibGlzaGVkIGZvciBydXN0LXRhci4KCkNWRS0y MDI2LTMzMDU2WzBdOgp8IHRhci1ycyBpcyBhIHRhciBhcmNoaXZlIHJlYWRpbmcvd3JpdGluZyBs aWJyYXJ5IGZvciBSdXN0LiBJbgp8IHZlcnNpb25zIDAuNC40NCBhbmQgYmVsb3csIHdoZW4gdW5w YWNraW5nIGEgdGFyIGFyY2hpdmUsIHRoZSB0YXIKfCBjcmF0ZSdzIHVucGFja19kaXIgZnVuY3Rp b24gdXNlcyBmczo6bWV0YWRhdGEoKSB0byBjaGVjayB3aGV0aGVyIGEKfCBwYXRoIHRoYXQgYWxy ZWFkeSBleGlzdHMgaXMgYSBkaXJlY3RvcnkuIEJlY2F1c2UgZnM6Om1ldGFkYXRhKCkKfCBmb2xs b3dzIHN5bWJvbGljIGxpbmtzLCBhIGNyYWZ0ZWQgdGFyYmFsbCBjb250YWluaW5nIGEgc3ltbGlu ayBlbnRyeQp8IGZvbGxvd2VkIGJ5IGEgZGlyZWN0b3J5IGVudHJ5IHdpdGggdGhlIHNhbWUgbmFt ZSBjYXVzZXMgdGhlIGNyYXRlIHRvCnwgdHJlYXQgdGhlIHN5bWxpbmsgdGFyZ2V0IGFzIGEgdmFs aWQgZXhpc3RpbmcgZGlyZWN0b3J5IOKAlCBhbmQKfCBzdWJzZXF1ZW50bHkgYXBwbHkgY2htb2Qg dG8gaXQuIFRoaXMgYWxsb3dzIGFuIGF0dGFja2VyIHRvIG1vZGlmeQp8IHRoZSBwZXJtaXNzaW9u cyBvZiBhcmJpdHJhcnkgZGlyZWN0b3JpZXMgb3V0c2lkZSB0aGUgZXh0cmFjdGlvbgp8IHJvb3Qu IFRoaXMgaXNzdWUgaGFzIGJlZW4gZml4ZWQgaW4gdmVyc2lvbiAwLjQuNDUuCgoKSWYgeW91IGZp eCB0aGUgdnVsbmVyYWJpbGl0eSBwbGVhc2UgYWxzbyBtYWtlIHN1cmUgdG8gaW5jbHVkZSB0aGUK Q1ZFIChDb21tb24gVnVsbmVyYWJpbGl0aWVzICYgRXhwb3N1cmVzKSBpZCBpbiB5b3VyIGNoYW5n ZWxvZyBlbnRyeS4KCkZvciBmdXJ0aGVyIGluZm9ybWF0aW9uIHNlZToKClswXSBodHRwczovL3Nl Y3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90cmFja2VyL0NWRS0yMDI2LTMzMDU2CiAgICBodHRw czovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUtMjAyNi0zMzA1NgpbMV0gaHR0cHM6Ly9n aXRodWIuY29tL2FsZXhjcmljaHRvbi90YXItcnMvc2VjdXJpdHkvYWR2aXNvcmllcy9HSFNBLWo0 eGYtMmcyOS01OXBoClsyXSBodHRwczovL2dpdGh1Yi5jb20vYWxleGNyaWNodG9uL3Rhci1ycy9j b21taXQvMTdiMWZkODRlNjMyMDcxY2I4ZWVmOWQzNzA5YmYzNDdiZDI2NjQ0NgoKUGxlYXNlIGFk anVzdCB0aGUgYWZmZWN0ZWQgdmVyc2lvbnMgaW4gdGhlIEJUUyBhcyBuZWVkZWQuCgpSZWdhcmRz LApTYWx2YXRvcmUK ]