Impact
In versions 0.6.0 and earlier of astral-tokio-tar, the unpack_in API could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it.
See GHSA-j4xf-2g29-59ph for the equivalent flaw in the tar crate.
Patches
Versions 0.6.1 and newer of astral-tokio-tar use fs::symlink_metdata rather than fs::metadata, avoiding the traversal.
Workarounds
Users are advised to upgrade to version 0.6.1 or newer to address this advisory.
Users should experience no breaking changes as a result of the patch above.
References
Attribution
Impact
In versions 0.6.0 and earlier of astral-tokio-tar, the
unpack_inAPI could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it.See GHSA-j4xf-2g29-59ph for the equivalent flaw in the
tarcrate.Patches
Versions 0.6.1 and newer of astral-tokio-tar use
fs::symlink_metdatarather thanfs::metadata, avoiding the traversal.Workarounds
Users are advised to upgrade to version 0.6.1 or newer to address this advisory.
Users should experience no breaking changes as a result of the patch above.
References
tarvulnerabilityAttribution