Bug 2379592 (CVE-2025-45582)

Summary:	CVE-2025-45582 tar: Tar path traversal
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gmalinko, janstey, pdelbell, praiskup, rstepani, source2806
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A relative path traversal flaw was found in the gnu tar utility. When archives with relative paths are extracted without the ‘--keep-old-files’ (‘-k’), the extraction process may overwrite existing files that the current user has access to. The server may be impacted if these files are critical to the operation of some service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2380006, 2380007
Bug Blocks:

Description OSIDB Bzimport 2025-07-11 17:01:11 UTC

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal.

Comment 4 errata-xmlrpc 2026-01-05 00:44:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:0002 https://access.redhat.com/errata/RHSA-2026:0002

Comment 5 errata-xmlrpc 2026-01-05 18:51:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:0067 https://access.redhat.com/errata/RHSA-2026:0067

Comment 6 errata-xmlrpc 2026-01-06 13:32:34 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:0135 https://access.redhat.com/errata/RHSA-2026:0135

Comment 7 errata-xmlrpc 2026-01-12 02:16:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:0434 https://access.redhat.com/errata/RHSA-2026:0434

Comment 8 errata-xmlrpc 2026-01-12 02:25:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:0435 https://access.redhat.com/errata/RHSA-2026:0435

Comment 11 Art 2026-05-04 18:05:49 UTC

When this patch will be available for RHEL 8?