-
Notifications
You must be signed in to change notification settings - Fork 65
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
RUSTSEC-2021-0080: Links in archive can create arbitrary directories #208
Comments
I've bumped the tar in cargo upstream that ensures minimum tar is 0.4.36 that has addressed this properly. When ever there is new crate release we can bump our dep to properly enforce minimum - Even by using the current cargo version 0.52.0 the tar that gets dep'ed in .lock is 0.4.38. I'm working on patch that solves another advisory as part of the cargo bump which has some interface changes. @tarcieri can you assign this to me pls. |
I'll close this since Cargo.lock now meets tar 0.4.38 [[package]] |
tar
0.4.35
When unpacking a tarball that contains a symlink the
tar
crate may createdirectories outside of the directory it's supposed to unpack into.
The function errors when it's trying to create a file, but the folders are
already created at this point.
This issue was discovered and reported by Martin Michaelis (@mgjm).
See advisory page for additional details.
The text was updated successfully, but these errors were encountered: