{"id":"CVE-2026-33056","aliases":["ALPINE-CVE-2026-33056","AZL-80315","AZL-80499","AZL-80502","AZL-80511","AZL-80523","AZL-83037","BELL-CVE-2026-33056","CLSA-2026-1788535576","DEBIAN-CVE-2026-33056","EUVD-2026-13616","GHSA-j4xf-2g29-59ph","RUSTSEC-2026-0067","UBUNTU-CVE-2026-33056","USN-8138-1","USN-8138-2","USN-8139-1","USN-8168-1","USN-8168-2"],"status":"published","title":"tar-rs: unpack_in can chmod arbitrary directories by following symlinks","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00394,"percentile":0.33946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2026-03-19T12:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"crates.io","package":"tar","fixed_in":["0.4.45"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"chromium-rust","fixed_in":["1.94.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"rust","fixed_in":["1.78.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rust","fixed_in":["1.83.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rust","fixed_in":["1.87.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rust","fixed_in":["1.91.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rust","fixed_in":["1.94.0-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rpm-ostree","fixed_in":["2024.4-10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.75.0-28","1.90.0-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"trident","fixed_in":["0.22.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"clamav","fixed_in":["1.5.2-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rust","fixed_in":["1.64.0-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"rust","fixed_in":["1.87.0-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rust","fixed_in":["1.94.0-r1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"cargo","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"clippy","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-analyzer","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-debugger-common","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-doc","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-gdb","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-lldb","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-src","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-std-static","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-std-static-wasm32-unknown-unknown","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-std-static-wasm32-wasip1","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-toolset","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rustfmt","fixed_in":["1.84.1-1.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-tar","fixed_in":["0.4.45-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rustc","fixed_in":["1.85.1+dfsg1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rustc","fixed_in":["1.92.0+dfsg1-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rust-tar","fixed_in":["0.4.37-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc","fixed_in":["1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.62","fixed_in":["1.62.1+dfsg1-1ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.76","fixed_in":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.77","fixed_in":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.78","fixed_in":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.79","fixed_in":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.80","fixed_in":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.81","fixed_in":["1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.82","fixed_in":["1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.83","fixed_in":["1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.84","fixed_in":["1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.85","fixed_in":["1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.89","fixed_in":["1.89.0+dfsg~24.04-0ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.91","fixed_in":["1.91.1+dfsg~22.04-0ubuntu0.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rust-tar","fixed_in":["0.4.40-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc","fixed_in":["1.75.0+dfsg0ubuntu1-0ubuntu7.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.74","fixed_in":["1.74.1+dfsg0ubuntu1-0ubuntu15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.76","fixed_in":["1.76.0+dfsg0ubuntu1-0ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.77","fixed_in":["1.77.2+dfsg1ubuntu1-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.78","fixed_in":["1.78.0+dfsg1ubuntu1-0ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.79","fixed_in":["1.79.0+dfsg1ubuntu1-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.80","fixed_in":["1.80.1+dfsg0ubuntu1-0ubuntu0.24.04.01"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.81","fixed_in":["1.81.0+dfsg0ubuntu1-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.82","fixed_in":["1.82.0+dfsg0ubuntu0-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.83","fixed_in":["1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.84","fixed_in":["1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.85","fixed_in":["1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.89","fixed_in":["1.89.0+dfsg~24.04-0ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.91","fixed_in":["1.91.1+dfsg~24.04-0ubuntu0.24.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rust-cargo-c","fixed_in":["0.10.11-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rust-tar","fixed_in":["0.4.43-4ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rustc-1.85","fixed_in":["1.85.1+dfsg0ubuntu2-0ubuntu1.25.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rustc-1.88","fixed_in":["1.88.0+dfsg0ubuntu1-0ubuntu2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rust-tar","fixed_in":["0.4.26-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rustc","fixed_in":["1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rustc","fixed_in":["1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rustc","fixed_in":["1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc","fixed_in":["1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.76","fixed_in":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.77","fixed_in":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.78","fixed_in":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.79","fixed_in":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.80","fixed_in":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.4.44"},{"fixed":"0.4.45"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"chromium-rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.87.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.91.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.94.0-r1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"tardev-snapshotter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.0.tardev1-11"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rpm-ostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.4-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0-28"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.90.0-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"trident","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"clamav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.64.0-r1"},{"fixed":"1.64.0-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.87.0-r1"},{"fixed":"1.87.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.69.0-r10"},{"fixed":"1.94.0-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"clippy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-analyzer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-debugger-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-gdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-lldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-std-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-std-static-wasm32-unknown-unknown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-std-static-wasm32-wasip1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rust-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rustfmt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.38-1","0.4.38-2","0.4.40-1","0.4.43-1","0.4.43-2","0.4.43-3","0.4.43-4","0.4.44-1","0.4.45-1","0.4.45-2","0.4.46-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.43-4","0.4.44-1","0.4.45-1","0.4.45-2","0.4.46-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.45-1"}]}],"versions":["0.4.43-4","0.4.44-1"]},{"source":"osv","ecosystem":"Debian:12","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.63.0+dfsg1-2","1.64.0+dfsg1-1","1.64.0+dfsg1-1~exp1","1.64.0+dfsg1-1~exp2","1.64.0+dfsg1-1~exp3","1.64.0+dfsg1-1~exp4","1.65.0+dfsg1-1","1.65.0+dfsg1-1~exp1","1.65.0+dfsg1-1~exp2","1.65.0+dfsg1-1~exp3","1.65.0+dfsg1-2","1.66.0+dfsg1-1","1.66.0+dfsg1-1~exp1","1.67.1+dfsg1-1","1.67.1+dfsg1-1~exp1","1.68.2+dfsg1-1","1.68.2+dfsg1-1~exp1","1.69.0+dfsg1-1","1.69.0+dfsg1-1~exp1","1.69.0+dfsg1-1~exp2","1.70.0+dfsg1-1","1.70.0+dfsg1-1~exp1","1.70.0+dfsg1-1~exp2","1.70.0+dfsg1-1~exp3","1.70.0+dfsg1-2","1.70.0+dfsg1-2~exp1","1.70.0+dfsg1-3","1.70.0+dfsg1-4","1.70.0+dfsg1-5","1.70.0+dfsg1-6","1.70.0+dfsg1-7","1.70.0+dfsg1-8","1.70.0+dfsg1-8.1","1.70.0+dfsg1-9","1.70.0+dfsg2-1","1.70.0+dfsg2-1+loong64","1.70.0+dfsg2-1~exp1","1.70.0+dfsg2-1~exp2","1.70.0+dfsg2-1~exp3","1.71.1+dfsg1-1","1.71.1+dfsg1-1~exp1","1.71.1+dfsg1-1~exp2","1.71.1+dfsg1-2","1.72.1+dfsg1-1","1.72.1+dfsg1-1+hurd.1","1.72.1+dfsg1-1~exp1","1.72.1+dfsg1-1~exp2","1.73.0+dfsg1-1","1.73.0+dfsg1-1+hurd.1","1.73.0+dfsg1-1+loong64","1.73.0+dfsg1-1~exp1","1.74.1+dfsg1-1","1.74.1+dfsg1-1+hurd.1","1.74.1+dfsg1-1~exp1","1.75.0+dfsg1-1","1.75.0+dfsg1-1~exp1","1.75.0+dfsg1-2","1.75.0+dfsg1-3","1.75.0+dfsg1-4","1.75.0+dfsg1-4+hurd.1","1.75.0+dfsg1-5","1.76.0+dfsg1-1","1.76.0+dfsg1-1+hurd.1","1.76.0+dfsg1-1~exp1","1.77.2+dfsg1-1","1.77.2+dfsg1-1~exp1","1.78.0+dfsg1-1~exp1","1.78.0+dfsg1-2","1.79.0+dfsg1-1","1.79.0+dfsg1-1~exp1","1.79.0+dfsg1-2","1.79.0+dfsg1-2+hurd.1","1.80.0+dfsg1-1~exp1","1.80.1+dfsg1-1","1.80.1+dfsg1-1+hurd.1","1.80.1+dfsg1-1~exp1","1.81.0+dfsg1-1","1.81.0+dfsg1-1~exp1","1.81.0+dfsg1-1~exp2","1.81.0+dfsg1-2","1.82.0+dfsg1-1","1.82.0+dfsg1-1~exp1","1.82.0+dfsg1-1~exp2","1.82.0+dfsg1-1~exp3","1.82.0+dfsg1-2","1.83.0+dfsg1-1","1.83.0+dfsg1-1~exp1","1.84.0+dfsg1-1","1.84.0+dfsg1-1~exp1","1.84.0+dfsg1-2","1.85.0+dfsg1-1","1.85.0+dfsg2-1","1.85.0+dfsg2-2","1.85.0+dfsg2-3","1.85.0+dfsg3-1","1.85.0~beta.9+dfsg1-1~exp1","1.86.0+dfsg1-1","1.86.0+dfsg1-1~bpo13+1","1.86.0+dfsg1-1~bpo13+2","1.86.0+dfsg1-1~exp1","1.86.0+dfsg1-1~exp2","1.86.0+dfsg1-1~exp2+x32","1.86.0+dfsg1-1~exp3","1.86.0+dfsg1-1~exp4","1.87.0+dfsg1-1","1.87.0+dfsg1-1~bpo13+1","1.87.0+dfsg1-1~bpo13+2","1.87.0+dfsg1-1~exp1","1.88.0+dfsg1-1","1.88.0+dfsg1-1~exp1","1.88.0+dfsg1-2","1.88.0+dfsg1-2~bpo13+1","1.89.0+dfsg1-1","1.89.0+dfsg1-1~bpo13+1","1.89.0+dfsg1-1~bpo13+2","1.89.0+dfsg1-1~exp1","1.90.0+dfsg1-1","1.90.0+dfsg1-1~bpo13+1","1.90.0+dfsg1-1~bpo13+2","1.90.0+dfsg1-1~exp1","1.91.1+dfsg1-1","1.91.1+dfsg1-1~bpo13+1","1.91.1+dfsg1-1~bpo13+2","1.91.1+dfsg1-1~exp1","1.91.1+dfsg1-1~exp2","1.91.1+dfsg1-1~exp3","1.92.0+dfsg1-1","1.92.0+dfsg1-1~exp1","1.92.0+dfsg1-2","1.92.0+dfsg1-2~bpo13+1","1.93.1+dfsg1-1","1.93.1+dfsg1-1~exp1","1.93.1+dfsg1-2","1.93.1+dfsg1-2~bpo13+1","1.94.1+dfsg1-1","1.94.1+dfsg1-1~bpo13+1","1.94.1+dfsg1-1~bpo13+2","1.94.1+dfsg1-1~bpo13+3","1.94.1+dfsg1-1~exp1","1.94.1+dfsg1-1~exp2","1.94.1+dfsg1-1~exp3","1.95.0+dfsg1-1","1.95.0+dfsg1-2","1.95.0+dfsg1-2~bpo13+1","1.96.0+dfsg1-1~exp1","1.96.1+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85.1+dfsg1-1+deb13u1"}]}],"versions":["1.85.0+dfsg3-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.92.0+dfsg1-2"}]}],"versions":["1.85.0+dfsg3-1","1.86.0+dfsg1-1","1.86.0+dfsg1-1~bpo13+1","1.86.0+dfsg1-1~bpo13+2","1.86.0+dfsg1-1~exp1","1.86.0+dfsg1-1~exp2","1.86.0+dfsg1-1~exp2+x32","1.86.0+dfsg1-1~exp3","1.86.0+dfsg1-1~exp4","1.87.0+dfsg1-1","1.87.0+dfsg1-1~bpo13+1","1.87.0+dfsg1-1~bpo13+2","1.87.0+dfsg1-1~exp1","1.88.0+dfsg1-1","1.88.0+dfsg1-1~exp1","1.88.0+dfsg1-2","1.88.0+dfsg1-2~bpo13+1","1.89.0+dfsg1-1","1.89.0+dfsg1-1~bpo13+1","1.89.0+dfsg1-1~bpo13+2","1.89.0+dfsg1-1~exp1","1.90.0+dfsg1-1","1.90.0+dfsg1-1~bpo13+1","1.90.0+dfsg1-1~bpo13+2","1.90.0+dfsg1-1~exp1","1.91.1+dfsg1-1","1.91.1+dfsg1-1~bpo13+1","1.91.1+dfsg1-1~bpo13+2","1.91.1+dfsg1-1~exp1","1.91.1+dfsg1-1~exp2","1.91.1+dfsg1-1~exp3","1.92.0+dfsg1-1","1.92.0+dfsg1-1~exp1","1.92.0+dfsg1-2~bpo13+1"]},{"source":"osv","ecosystem":"crates.io","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.45"}]}]},{"source":"osv","ecosystem":"crates.io","package":"tar","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.45"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.1+dfsg0-1~exp1ubuntu2~14.04.7","1.17.0+dfsg2-8~ubuntu0.14.04.3","1.21.0+dfsg1+llvm-0ubuntu3~14.04.5","1.22.1+dfsg1+llvm-0ubuntu2~14.04.2","1.24.1+dfsg1+llvm-0ubuntu1~14.04.1","1.25.0+dfsg1+llvm-0ubuntu1~14.04.1","1.28.0+dfsg1+llvm-0ubuntu1~14.04.1","1.30.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.0-1","0.16.0-0ubuntu1~16.04.1","0.18.0-0ubuntu0.16.04.1","0.22.0-0ubuntu0.16.04.1","0.23.0-0ubuntu0.16.04.1","0.25.0-1ubuntu1~16.04.1","0.26.0-0ubuntu2~16.04.1","0.29.0-1ubuntu1~16.04.1","0.31.0-3ubuntu1~16.04.1","0.32.0-1~exp1ubuntu1~16.04.1","0.33.0-1ubuntu1~16.04.1","0.35.0-0ubuntu1~16.04.1","0.36.0-0ubuntu1~16.04.1","0.37.0-3ubuntu1~16.04.1","0.38.0-0ubuntu1~16.04.1","0.40.0-3ubuntu1~16.04.1","0.42.0-0ubuntu1~16.04.1","0.44.1-0ubuntu1~16.04.1","0.47.0-1~exp1ubuntu1~16.04.1","0.47.0-1~exp1ubuntu1~16.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.0+dfsg1-1","1.15.1+dfsg0-1~exp1ubuntu2~16.04.3","1.17.0+dfsg2-8~ubuntu0.16.04.2","1.21.0+dfsg1+llvm-0ubuntu3~16.04.1","1.22.1+dfsg1+llvm-0ubuntu2~16.04.2","1.24.1+dfsg1+llvm-0ubuntu1~16.04.1","1.25.0+dfsg1+llvm-0ubuntu1~16.04.1","1.28.0+dfsg1+llvm-0ubuntu1~16.04.1","1.30.0+dfsg1+llvm-2ubuntu1~16.04.1","1.31.0+dfsg1+llvm-2ubuntu1~16.04.1","1.32.0+dfsg1+llvm-1ubuntu1~16.04.1","1.34.1+dfsg2+llvm-0ubuntu1~16.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1","1.36.0+dfsg1+llvm-2ubuntu1~16.04.1","1.37.0+dfsg1+llvm-1ubuntu1~16.04.1","1.39.0+dfsg1+llvm-3ubuntu1~16.04.1","1.41.0+dfsg1+llvm-0ubuntu1~16.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.19.0-0ubuntu1","0.22.0-0ubuntu1","0.22.0-0ubuntu2","0.23.0-0ubuntu1","0.24.0-1ubuntu1","0.25.0-1ubuntu1","0.26.0-0ubuntu1","0.26.0-0ubuntu2","0.29.0-1ubuntu1~18.04.1","0.31.0-3ubuntu1~18.04.4","0.32.0-1~exp1ubuntu1~18.04.1","0.33.0-1ubuntu1~18.04.1","0.35.0-0ubuntu1~18.04.1","0.36.0-0ubuntu1~18.04.1","0.37.0-3ubuntu1~18.04.1","0.38.0-0ubuntu1~18.04.1","0.40.0-3ubuntu1~18.04.1","0.42.0-0ubuntu1~18.04.1","0.44.1-0ubuntu1~18.04.1","0.47.0-1~exp1ubuntu1~18.04.1","0.52.0-0ubuntu1~18.04.1","0.54.0-0ubuntu1~18.04.1","0.58.0-0ubuntu1~18.04.1","0.60.0ubuntu1-0ubuntu1~18.04.1","0.62.0ubuntu0libgit2-0ubuntu0.18.04.1","0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04","0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.0+dfsg1-4ubuntu1","1.24.1+dfsg1+llvm-0ubuntu1","1.24.1+dfsg1+llvm-0ubuntu2","1.25.0+dfsg1+llvm-0ubuntu1","1.28.0+dfsg1+llvm-0ubuntu1~18.04.1","1.30.0+dfsg1+llvm-2ubuntu1~18.04.1","1.31.0+dfsg1+llvm-2ubuntu1~18.04.1","1.32.0+dfsg1+llvm-1ubuntu1~18.04.1","1.34.1+dfsg2+llvm-0ubuntu1~18.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~18.04.1","1.36.0+dfsg1+llvm-2ubuntu1~18.04.1","1.37.0+dfsg1+llvm-1ubuntu1~18.04.1","1.39.0+dfsg1+llvm-3ubuntu1~18.04.1","1.41.0+dfsg1+llvm-0ubuntu1~18.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~18.04.1","1.47.0+dfsg1+llvm-1ubuntu1~18.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~18.04.1","1.53.0+dfsg1+llvm-4ubuntu1~18.04.1","1.57.0+dfsg1+llvm-0ubuntu1~18.04.1","1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~18.04.2","1.61.0+dfsg1~llvm-1~exp1ubuntu0.18.04.1","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.37.0-3ubuntu2","0.38.0-0ubuntu1","0.39.0-0ubuntu1","0.39.0+really0.38.0-0ubuntu1","0.39.0+really0.39.0-0ubuntu1","0.40.0-3ubuntu1","0.40.0-3ubuntu2","0.41.0-0ubuntu1","0.42.0-0ubuntu1","0.44.1-0ubuntu1~20.04.1","0.47.0-1~exp1ubuntu1~20.04.1","0.52.0-0ubuntu1~20.04.1","0.54.0-0ubuntu1~20.04.1","0.58.0-0ubuntu1~20.04.1","0.60.0ubuntu1-0ubuntu1~20.04.1","0.62.0ubuntu0libgit2-0ubuntu0.20.04.1","0.66.0+ds0ubuntu0.libgit2-0ubuntu0.20.04","0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2","0.67.1+ds0ubuntu0.libgit2-0ubuntu0.20.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.26-1","0.4.26-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.37.0+dfsg1+llvm-1ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu2","1.39.0+dfsg1+llvm-3ubuntu1","1.40.0+dfsg1+llvm-5ubuntu1","1.41.0+dfsg1+llvm-0ubuntu1","1.41.0+dfsg1+llvm-0ubuntu2","1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1","1.47.0+dfsg1+llvm-1ubuntu1~20.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2","1.53.0+dfsg1+llvm-4ubuntu1~20.04.1","1.57.0+dfsg1+llvm-0ubuntu1~20.04.1","1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2","1.61.0+dfsg1~llvm-1~exp1ubuntu0.20.04.1","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.20.04","1.66.1+dfsg0ubuntu1~llvm-0ubuntu0.20.04","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04.1","1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.20.04","1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04","1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04","1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1","1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.37-3ubuntu0.1"}]}],"versions":["0.4.26-1","0.4.37-1","0.4.37-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.51.0+dfsg1+llvm-1~exp3ubuntu1","1.53.0+dfsg1+llvm-4ubuntu1","1.54.0+dfsg2+llvm-3ubuntu1","1.56.0+dfsg1+llvm-2ubuntu1","1.56.0+dfsg1+llvm-2ubuntu2","1.57.0+dfsg1+llvm-0ubuntu1","1.57.0+dfsg1+llvm-0ubuntu2","1.58.1+dfsg1~ubuntu1-0ubuntu1","1.58.1+dfsg1~ubuntu1-0ubuntu2","1.59.0+dfsg1-1~ubuntu2~22.04.1","1.61.0+dfsg1-1~exp1ubuntu0.22.04.1","1.65.0+dfsg0ubuntu1-0ubuntu0.22.04.1","1.66.1+dfsg0ubuntu1-0ubuntu0.22.04.1","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.22.04.1","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.22.04.2","1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.22.04","1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.62","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.62.1+dfsg1-1ubuntu0.22.04.3"}]}],"versions":["1.62.1+dfsg1-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1"}]}],"versions":["1.81.0+dfsg0ubuntu0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.82","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04.1"}]}],"versions":["1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04.1"}]}],"versions":["1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04~ppa3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04.1"}]}],"versions":["1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04.1"}]}],"versions":["1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.22.03","1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.89","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.89.0+dfsg~24.04-0ubuntu0.22.04.2"}]}],"versions":["1.89.0+dfsg~24.04-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.91.1+dfsg~22.04-0ubuntu0.22.04.3"}]}],"versions":["1.91.1+dfsg~22.04-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"cargo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.52.0-0ubuntu1","0.53.0-0ubuntu2","0.54.0-0ubuntu1","0.54.0-0ubuntu2","0.57.0+ubuntu-0ubuntu1","0.58.0-0ubuntu1","0.60.0ubuntu1-0ubuntu1~22.04.1","0.62.0ubuntu0libgit2-0ubuntu0.22.04.1","0.66.0+ds0ubuntu0.libgit2-0ubuntu0.22.04","0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2","0.67.1+ds0ubuntu0.libgit2-0ubuntu0.22.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-async-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.14-1","0.9.14-2","0.9.14-2build1","0.9.19-1","0.9.19-2","0.9.19-2build2","0.9.19-2build3","0.9.19-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.40-1ubuntu0.1"}]}],"versions":["0.4.38-2","0.4.40-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0+dfsg0ubuntu1-0ubuntu7.4"}]}],"versions":["1.71.1+dfsg0ubuntu2-0ubuntu1","1.73.0+dfsg0ubuntu1-0ubuntu1","1.74.1+dfsg0ubuntu1-0ubuntu1","1.75.0+dfsg0ubuntu1-0ubuntu1","1.75.0+dfsg0ubuntu1-0ubuntu6","1.75.0+dfsg0ubuntu1-0ubuntu7","1.75.0+dfsg0ubuntu1-0ubuntu7.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.74","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.1+dfsg0ubuntu1-0ubuntu15"}]}],"versions":["1.74.1+dfsg0ubuntu1-0ubuntu2","1.74.1+dfsg0ubuntu1-0ubuntu13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0+dfsg0ubuntu1-0ubuntu0.24.04.2"}]}],"versions":["1.76.0+dfsg0ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.77.2+dfsg1ubuntu1-0ubuntu0.24.04.1"}]}],"versions":["1.77.2+dfsg1ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.0+dfsg1ubuntu1-0ubuntu0.24.04.2"}]}],"versions":["1.78.0+dfsg1ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0+dfsg1ubuntu1-0ubuntu0.24.04.1"}]}],"versions":["1.79.0+dfsg1ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.1+dfsg0ubuntu1-0ubuntu0.24.04.01"}]}],"versions":["1.80.1+dfsg0ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.81.0+dfsg0ubuntu1-0ubuntu0.24.04.1"}]}],"versions":["1.81.0+dfsg0ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.82","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.82.0+dfsg0ubuntu0-0ubuntu0.24.04.1"}]}],"versions":["1.82.0+dfsg0ubuntu0-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04.1"}]}],"versions":["1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04.1"}]}],"versions":["1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2"}]}],"versions":["1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.89","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.89.0+dfsg~24.04-0ubuntu0.24.04.2"}]}],"versions":["1.89.0+dfsg~24.04-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.91.1+dfsg~24.04-0ubuntu0.24.04.2"}]}],"versions":["1.91.1+dfsg~24.04-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.1-1","0.5.2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-async-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.11-1ubuntu1.1"}]}],"versions":["0.10.11-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.43-4ubuntu0.1"}]}],"versions":["0.4.43-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85.1+dfsg0ubuntu2-0ubuntu1.25.04.1"}]}],"versions":["1.85.1+dfsg0ubuntu1-0ubuntu1","1.85.1+dfsg0ubuntu2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rustc-1.88","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.88.0+dfsg0ubuntu1-0ubuntu2"}]}],"versions":["1.88.0+dfsg0ubuntu1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.6-2","0.6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-astral-tokio-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.2-2","0.5.5-1","0.5.6-1","0.5.6-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.37-3ubuntu0.1"}]}],"versions":["0.4.26-1","0.4.37-1","0.4.37-3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.40-1ubuntu0.1"}]}],"versions":["0.4.38-2","0.4.40-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.43-4ubuntu0.1"}]}],"versions":["0.4.43-4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rust-tar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.26-1ubuntu0.1"}]}],"versions":["0.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-cargo-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.11-1ubuntu1.1"}]}],"versions":["0.10.11-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.51.0+dfsg1+llvm-1~exp3ubuntu1","1.53.0+dfsg1+llvm-4ubuntu1","1.54.0+dfsg2+llvm-3ubuntu1","1.56.0+dfsg1+llvm-2ubuntu1","1.56.0+dfsg1+llvm-2ubuntu2","1.57.0+dfsg1+llvm-0ubuntu1","1.57.0+dfsg1+llvm-0ubuntu2","1.58.1+dfsg1~ubuntu1-0ubuntu1","1.58.1+dfsg1~ubuntu1-0ubuntu2","1.59.0+dfsg1-1~ubuntu2~22.04.1","1.61.0+dfsg1-1~exp1ubuntu0.22.04.1","1.65.0+dfsg0ubuntu1-0ubuntu0.22.04.1","1.66.1+dfsg0ubuntu1-0ubuntu0.22.04.1","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.22.04.1","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.22.04.2","1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.22.04","1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.62","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.62.1+dfsg1-1ubuntu0.22.04.3"}]}],"versions":["1.62.1+dfsg1-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04.1"}]}],"versions":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1"}]}],"versions":["1.81.0+dfsg0ubuntu0-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.82","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04.1"}]}],"versions":["1.82.0+dfsg0ubuntu0~jammy-0ubuntu0.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04.1"}]}],"versions":["1.83.0+dfsg0ubuntu2~bpo2-0ubuntu2.22.04~ppa3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04.1"}]}],"versions":["1.84.1+dfsg0ubuntu1~bpo10-0ubuntu4.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04.1"}]}],"versions":["1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.22.03","1.85.1+dfsg0ubuntu2~bpo0-0ubuntu1.22.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.89","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.89.0+dfsg~24.04-0ubuntu0.22.04.2"}]}],"versions":["1.89.0+dfsg~24.04-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rustc-1.91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.91.1+dfsg~22.04-0ubuntu0.22.04.3"}]}],"versions":["1.91.1+dfsg~22.04-0ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0+dfsg0ubuntu1-0ubuntu7.4"}]}],"versions":["1.71.1+dfsg0ubuntu2-0ubuntu1","1.73.0+dfsg0ubuntu1-0ubuntu1","1.74.1+dfsg0ubuntu1-0ubuntu1","1.75.0+dfsg0ubuntu1-0ubuntu1","1.75.0+dfsg0ubuntu1-0ubuntu6","1.75.0+dfsg0ubuntu1-0ubuntu7","1.75.0+dfsg0ubuntu1-0ubuntu7.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.74","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.74.1+dfsg0ubuntu1-0ubuntu15"}]}],"versions":["1.74.1+dfsg0ubuntu1-0ubuntu2","1.74.1+dfsg0ubuntu1-0ubuntu13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0+dfsg0ubuntu1-0ubuntu0.24.04.2"}]}],"versions":["1.76.0+dfsg0ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.77.2+dfsg1ubuntu1-0ubuntu0.24.04.1"}]}],"versions":["1.77.2+dfsg1ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.0+dfsg1ubuntu1-0ubuntu0.24.04.2"}]}],"versions":["1.78.0+dfsg1ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0+dfsg1ubuntu1-0ubuntu0.24.04.1"}]}],"versions":["1.79.0+dfsg1ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.1+dfsg0ubuntu1-0ubuntu0.24.04.01"}]}],"versions":["1.80.1+dfsg0ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.81","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.81.0+dfsg0ubuntu1-0ubuntu0.24.04.1"}]}],"versions":["1.81.0+dfsg0ubuntu1-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.82","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.82.0+dfsg0ubuntu0-0ubuntu0.24.04.1"}]}],"versions":["1.82.0+dfsg0ubuntu0-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.83","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04.1"}]}],"versions":["1.83.0+dfsg0ubuntu1~bpo2-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.84","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04.1"}]}],"versions":["1.84.1+dfsg0ubuntu1~bpo2-0ubuntu2.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2"}]}],"versions":["1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.89","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.89.0+dfsg~24.04-0ubuntu0.24.04.2"}]}],"versions":["1.89.0+dfsg~24.04-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rustc-1.91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.91.1+dfsg~24.04-0ubuntu0.24.04.2"}]}],"versions":["1.91.1+dfsg~24.04-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rustc-1.85","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.85.1+dfsg0ubuntu2-0ubuntu1.25.04.1"}]}],"versions":["1.85.1+dfsg0ubuntu1-0ubuntu1","1.85.1+dfsg0ubuntu2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rustc-1.88","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.88.0+dfsg0ubuntu1-0ubuntu2"}]}],"versions":["1.88.0+dfsg0ubuntu1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0+dfsg1+llvm-2ubuntu1~14.04.1ubuntu1"}]}],"versions":["1.15.1+dfsg0-1~exp1ubuntu2~14.04.7","1.17.0+dfsg2-8~ubuntu0.14.04.3","1.21.0+dfsg1+llvm-0ubuntu3~14.04.5","1.22.1+dfsg1+llvm-0ubuntu2~14.04.2","1.24.1+dfsg1+llvm-0ubuntu1~14.04.1","1.25.0+dfsg1+llvm-0ubuntu1~14.04.1","1.28.0+dfsg1+llvm-0ubuntu1~14.04.1","1.30.0+dfsg1+llvm-2ubuntu1~14.04.1","1.31.0+dfsg1+llvm-2ubuntu1~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.47.0+dfsg1+llvm-1ubuntu1~16.04.1ubuntu2"}]}],"versions":["1.7.0+dfsg1-1","1.15.1+dfsg0-1~exp1ubuntu2~16.04.3","1.17.0+dfsg2-8~ubuntu0.16.04.2","1.21.0+dfsg1+llvm-0ubuntu3~16.04.1","1.22.1+dfsg1+llvm-0ubuntu2~16.04.2","1.24.1+dfsg1+llvm-0ubuntu1~16.04.1","1.25.0+dfsg1+llvm-0ubuntu1~16.04.1","1.28.0+dfsg1+llvm-0ubuntu1~16.04.1","1.30.0+dfsg1+llvm-2ubuntu1~16.04.1","1.31.0+dfsg1+llvm-2ubuntu1~16.04.1","1.32.0+dfsg1+llvm-1ubuntu1~16.04.1","1.34.1+dfsg2+llvm-0ubuntu1~16.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~16.04.1","1.36.0+dfsg1+llvm-2ubuntu1~16.04.1","1.37.0+dfsg1+llvm-1ubuntu1~16.04.1","1.39.0+dfsg1+llvm-3ubuntu1~16.04.1","1.41.0+dfsg1+llvm-0ubuntu1~16.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~16.04.1","1.47.0+dfsg1+llvm-1ubuntu1~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04.1"}]}],"versions":["1.18.0+dfsg1-4ubuntu1","1.24.1+dfsg1+llvm-0ubuntu1","1.24.1+dfsg1+llvm-0ubuntu2","1.25.0+dfsg1+llvm-0ubuntu1","1.28.0+dfsg1+llvm-0ubuntu1~18.04.1","1.30.0+dfsg1+llvm-2ubuntu1~18.04.1","1.31.0+dfsg1+llvm-2ubuntu1~18.04.1","1.32.0+dfsg1+llvm-1ubuntu1~18.04.1","1.34.1+dfsg2+llvm-0ubuntu1~18.04.1","1.35.0+dfsg0.1+llvm-0ubuntu1~18.04.1","1.36.0+dfsg1+llvm-2ubuntu1~18.04.1","1.37.0+dfsg1+llvm-1ubuntu1~18.04.1","1.39.0+dfsg1+llvm-3ubuntu1~18.04.1","1.41.0+dfsg1+llvm-0ubuntu1~18.04.1","1.43.0+dfsg1+llvm-1~exp1ubuntu2~18.04.1","1.47.0+dfsg1+llvm-1ubuntu1~18.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~18.04.1","1.53.0+dfsg1+llvm-4ubuntu1~18.04.1","1.57.0+dfsg1+llvm-0ubuntu1~18.04.1","1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~18.04.2","1.61.0+dfsg1~llvm-1~exp1ubuntu0.18.04.1","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.37.0+dfsg1+llvm-1ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu1","1.38.0+dfsg0.2+llvm-0ubuntu2","1.39.0+dfsg1+llvm-3ubuntu1","1.40.0+dfsg1+llvm-5ubuntu1","1.41.0+dfsg1+llvm-0ubuntu1","1.41.0+dfsg1+llvm-0ubuntu2","1.43.0+dfsg1+llvm-1~exp1ubuntu1~20.04.1","1.47.0+dfsg1+llvm-1ubuntu1~20.04.1","1.51.0+dfsg1+llvm-1~exp3ubuntu1~20.04.2","1.53.0+dfsg1+llvm-4ubuntu1~20.04.1","1.57.0+dfsg1+llvm-0ubuntu1~20.04.1","1.59.0+dfsg1~ubuntu1~llvm-1~ubuntu1~20.04.2","1.61.0+dfsg1~llvm-1~exp1ubuntu0.20.04.1","1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.20.04","1.66.1+dfsg0ubuntu1~llvm-0ubuntu0.20.04","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04","1.70.0+dfsg0ubuntu1~bpo2-0ubuntu0.20.04.1","1.71.1+dfsg0ubuntu3~bpo0-0ubuntu0.20.04","1.72.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04","1.73.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","1.74.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1","1.75.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.76","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.76.0+dfsg0ubuntu1~bpo0-0ubuntu0.20.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.77","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.77.2+dfsg1ubuntu1~bpo0-0ubuntu0.20.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.78.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.79","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.3"}]}],"versions":["1.79.0+dfsg1ubuntu1~bpo0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rustc-1.80","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04.1"}]}],"versions":["1.80.1+dfsg0ubuntu1~bpo0-0ubuntu0.20.04"]}],"products":[{"vendor":"alexcrichton","product":"tar-rs"},{"vendor":"tar_project","product":"tar"}],"references":[{"url":"https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33056","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0067.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-j4xf-2g29-59ph"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-33056","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-33056","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788535576.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33056.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33056","tags":["advisory"]},{"url":"https://github.com/alexcrichton/tar-rs","tags":["package"]},{"url":"https://crates.io/crates/tar","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-33056","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33056","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8139-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8138-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8168-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8138-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8168-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-33056","title":"tar-rs: unpack_in can chmod arbitrary directories by following symlinks","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T07:11:10.448Z","modified":"2026-03-20T12:59:30.468Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13616","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T07:11:10Z","modified":"2026-03-20T12:59:30Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:32.430758Z"}],"ghsa":[{"id":"GHSA-j4xf-2g29-59ph","title":"tar-rs `unpack_in` can chmod arbitrary directories by following symlinks","description":"## Summary\n\nWhen unpacking a tar archive, the `tar` crate's `unpack_dir` function uses `fs::metadata()` to check whether a path that already exists is a directory. Because `fs::metadata()` follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply `chmod` to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root.\n\n## Reproducer\n\nA malicious tarball contains two entries: (1) a symlink `foo` pointing to an arbitrary external directory, and (2) a directory entry `foo/.` (or just `foo`). When unpacked, `create_dir(\"foo\")` fails with `EEXIST` because the symlink is already on disk. The `fs::metadata()` check then follows the symlink, sees a directory at the target, and allows processing to continue. The directory entry's mode bits are then applied via `chmod`, which also follows the symlink — modifying the permissions of the external target directory.\n\n## Fix \n\nThe fix is very simple, we now use `fs::symlink_metadata()` in `unpack_dir`, so symlinks are detected and rejected rather than followed.\n\n## Credit\n\nThis issue was reported by @xokdvium - thank you!","status":"published","published":"2026-03-20T17:25:09Z","modified":"2026-03-25T18:36:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:39:41.724707Z"}],"nvd":[{"id":"CVE-2026-33056","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11.603Z","modified":"2026-06-17T10:36:52.55Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"ALPINE-CVE-2026-33056","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11.603Z","modified":"2026-11-03T06:33:02.365275546Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"BELL-CVE-2026-33056","status":"published","published":"2026-03-21T06:35:28.493215Z","modified":"2026-04-01T07:15:43.953658Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-33056","title":"tar-rs: unpack_in can chmod arbitrary directories by following symlinks","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T07:11:10.448Z","modified":"2026-10-28T02:31:04.495406382Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-33056","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11.603Z","modified":"2026-10-01T03:03:04.566229252Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-j4xf-2g29-59ph","title":"tar-rs `unpack_in` can chmod arbitrary directories by following symlinks","description":"## Summary\n\nWhen unpacking a tar archive, the `tar` crate's `unpack_dir` function uses `fs::metadata()` to check whether a path that already exists is a directory. Because `fs::metadata()` follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply `chmod` to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root.\n\n## Reproducer\n\nA malicious tarball contains two entries: (1) a symlink `foo` pointing to an arbitrary external directory, and (2) a directory entry `foo/.` (or just `foo`). When unpacked, `create_dir(\"foo\")` fails with `EEXIST` because the symlink is already on disk. The `fs::metadata()` check then follows the symlink, sees a directory at the target, and allows processing to continue. The directory entry's mode bits are then applied via `chmod`, which also follows the symlink — modifying the permissions of the external target directory.\n\n## Fix \n\nThe fix is very simple, we now use `fs::symlink_metadata()` in `unpack_dir`, so symlinks are detected and rejected rather than followed.\n\n## Credit\n\nThis issue was reported by @xokdvium - thank you!","status":"published","published":"2026-03-20T17:25:09Z","modified":"2026-09-10T03:50:39.751471613Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"RUSTSEC-2026-0067","title":"`unpack_in` can chmod arbitrary directories by following symlinks","description":"In versions 0.4.44 and below of tar-rs, when unpacking a tar archive, the tar\ncrate's `unpack_dir` function uses [`fs::metadata()`][fs-metadata] to check\nwhether a path that already exists is a directory. Because `fs::metadata()`\nfollows symbolic links, a crafted tarball containing a symlink entry followed\nby a directory entry with the same name causes the crate to treat the symlink\ntarget as a valid existing directory — and subsequently apply chmod to it. This\nallows an attacker to modify the permissions of arbitrary directories outside\nthe extraction root.\n\nThis issue has been fixed in version 0.4.45.\n\n[fs-metadata]: https://doc.rust-lang.org/std/fs/fn.metadata.html","status":"published","published":"2026-03-19T12:00:00Z","modified":"2026-03-23T09:45:06.946281Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:53:40.430679Z"},{"id":"UBUNTU-CVE-2026-33056","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:00Z","modified":"2026-10-17T12:59:59.357273277Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-80315","title":"CVE-2026-33056 affecting package tardev-snapshotter 3.2.0.tardev1-11","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-80499","title":"CVE-2026-33056 affecting package rpm-ostree for versions less than 2024.4-10","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-80502","title":"CVE-2026-33056 affecting package rust for versions less than 1.75.0-28","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-80511","title":"CVE-2026-33056 affecting package rust for versions less than 1.90.0-7","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-80523","title":"CVE-2026-33056 affecting package trident for versions less than 0.22.0-1","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11Z","modified":"2026-08-28T17:56:58.713768Z","updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"AZL-83037","title":"CVE-2026-33056 affecting package clamav for versions less than 1.5.2-2","description":"tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.","status":"published","published":"2026-03-20T08:16:11Z","modified":"2026-08-28T17:56:37.770868Z","updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"CLSA-2026-1788535576","title":"rust: Fix of CVE-2026-33056","description":"- CVE-2026-33056: in the vendored tar crate, use symlink_metadata instead of\n  metadata when deciding whether an existing path is a directory, so a\n  symlink cannot redirect the subsequent chmod outside the extraction root\n  (applied to all three vendored copies: tar 0.4.38, 0.4.42 and 0.4.43)","status":"published","published":"2026-09-04T15:26:27Z","modified":"2026-10-26T09:31:32.613157059Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"USN-8138-1","title":"rust-tar vulnerability","description":"It was discovered that tar-rs incorrectly handled symlinks when unpacking a\ntar archive. If a user or automated system were tricked into processing a\nspecially crafted tar archive, a remote attacker could use this issue to\nmodify permissions of arbitrary directories outside the extraction root,\nand possibly escalate privileges.","status":"published","published":"2026-04-01T13:35:16Z","modified":"2026-04-27T18:44:53.861584Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8138-2","title":"rust-tar vulnerability","description":"USN-8138-1 fixed a vulnerability in tar-rs. This update provides the\ncorresponding update for Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that tar-rs incorrectly handled symlinks when unpacking\n a tar archive. If a user or automated system were tricked into processing\n a specially crafted tar archive, a remote attacker could use this issue to\n modify permissions of arbitrary directories outside the extraction root,\n and possibly escalate privileges.","status":"published","published":"2026-04-14T20:01:22Z","modified":"2026-04-27T18:45:39.58394Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8139-1","title":"rust-cargo-c vulnerability","description":"It was discovered that tar-rs embedded in cargo-c incorrectly handled\nsymlinks when unpacking a tar archive. If a user or automated system were\ntricked into processing a specially crafted tar archive, a remote attacker\ncould use this issue to modify permissions of arbitrary directories outside\nthe extraction root, and possibly escalate privileges.","status":"published","published":"2026-04-01T13:44:32Z","modified":"2026-04-27T18:44:35.660049Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8168-1","title":"rustc vulnerability","description":"It was discovered that tar-rs embedded in rustc incorrectly handled\nsymlinks when unpacking a tar archive. If a user or automated system were\ntricked into processing a specially crafted tar archive, a remote attacker\ncould use this issue to modify permissions of arbitrary directories outside\nthe extraction root, and possibly escalate privileges.","status":"published","published":"2026-04-13T12:35:50Z","modified":"2026-04-27T18:47:51.804969Z","updated_at":"2026-11-02T16:58:22.951676Z"},{"id":"USN-8168-2","title":"rustc, rustc-1.76, rustc-1.77, rustc-1.78, rustc-1.79, rustc-1.80\nvulnerability","description":"USN-8168-1 fixed a vulnerability in Rust. This update provides the\ncorresponding update to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04\nLTS and Ubuntu 20.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that tar-rs embedded in rustc incorrectly handled\n symlinks when unpacking a tar archive. If a user or automated system were\n tricked into processing a specially crafted tar archive, a remote attacker\n could use this issue to modify permissions of arbitrary directories\n outside the extraction root, and possibly escalate privileges.","status":"published","published":"2026-04-14T18:01:04Z","modified":"2026-06-29T13:51:18.886908178Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}