Bug 2379592 (CVE-2025-45582)

Summary: CVE-2025-45582 tar: Tar path traversal
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: achen, gmalinko, janstey, pdelbell, praiskup, rhel-process-autobot, rstepani, source2806, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in GNU Tar. An attacker could exploit this vulnerability by providing two specially crafted TAR archives, if those archives were extracted in the same directory. The first archive contains a symbolic link that points to a critical directory. The second archive, when extracted, uses this symbolic link to overwrite sensitive files on the system, bypassing existing directory traversal protections. This could lead to unauthorized file modification or, in some cases, privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2380006, 2380007    
Bug Blocks:    

Description OSIDB Bzimport 2025-07-11 17:01:11 UTC 
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal.
Comment 4 errata-xmlrpc 2026-01-05 00:44:16 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:0002 https://access.redhat.com/errata/RHSA-2026:0002
Comment 5 errata-xmlrpc 2026-01-05 18:51:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:0067 https://access.redhat.com/errata/RHSA-2026:0067
Comment 6 errata-xmlrpc 2026-01-06 13:32:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:0135 https://access.redhat.com/errata/RHSA-2026:0135
Comment 7 errata-xmlrpc 2026-01-12 02:16:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:0434 https://access.redhat.com/errata/RHSA-2026:0434
Comment 8 errata-xmlrpc 2026-01-12 02:25:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:0435 https://access.redhat.com/errata/RHSA-2026:0435
Comment 11 Art 2026-05-04 18:05:49 UTC 
When this patch will be available for RHEL 8?
Comment 13 Andrew 2026-07-17 20:00:57 UTC 
Will there be a fix for CVE-2025-45582 on CentOS Stream 9?