328 matches found
astral-tokio-tar Vulnerable to PAX Header Desynchronization
Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrect...
apple-opensource-downloader (0.1.0), async_bagit (>=0.1.0, <=0.2.0) +14 more potentially affected by CVE-2025-62518 via tokio-tar (0.3.1)
tokio-tar CARGO version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-tar and may be impacted: - apple-opensource-downloader 0.1.0 - asyncbagit =0.1.0, =0.1.8, =0.8.0, =0.7.0, =0.2.0, =0.0.0, =0.1.0, =0.2.5, =0.4.0, =0.2.14, =0.6.0,...
RUSTSEC-2025-0110 astral-tokio-tar Vulnerable to PAX Header Desynchronization
Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrect...
`tokio-tar` parses PAX extended headers incorrectly, allows file smuggling
The archive reader incorrectly handles PAX extended headers, when the ustar header incorrectly specifies zero size size=000000000000, while a PAX header specifies a non-zero size, tokio-tar::Archive is going to read the file content as tar entry header. This can be used by a tar file to present...
astral-tokio-tar 安全漏洞
astral-tokio-tar is a Rust library open-sourced by Astral. A security vulnerability exists in astral-tokio-tar versions prior to 0.5.6, which stems from inconsistent boundary parsing and could result in the contents of an interpreted file being a legal tar header...
PT-2025-42899
Name of the Vulnerable Software and Affected Versions astral-tokio-tar versions prior to 0.5.6 async-tar versions prior to 0.5.6 tokio-tar versions prior to 0.5.6 Description astral-tokio-tar, async-tar, and tokio-tar are vulnerable to a boundary parsing issue due to inconsistent handling of...
EUVD-2021-1512
Malware in sbrugna...
EUVD-2021-1514
Malware in sbrugna...
EUVD-2022-0582
Malicious code in bioql PyPI...
EUVD-2025-29415
Malicious code in bioql PyPI...
EUVD-2024-1000
Malicious code in bioql PyPI...
EUVD-2023-0393
Malicious code in bioql PyPI...
EUVD-2023-3262
Malicious code in bioql PyPI...
EUVD-2025-30897
Malicious code in bioql PyPI...
[SECURITY] Fedora 43 Update: rust-astral-tokio-tar-0.5.5-1.fc43
A Rust implementation of an async TAR file reader and writer. This library does not currently handle compression, but it is abstract over all I/O readers and writers. Additionally, great lengths are taken to ensure that the entire contents are never required to be entirely resident in memory all ...
Fedora: Security Advisory (FEDORA-2025-414364f69d)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory (FEDORA-2025-5e50082948)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Linux Distros Unpatched Vulnerability : CVE-2025-59825
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of...
astral-tokio-tar has a path traversal in tar extraction
...
CVE-2025-59825
astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...