Bug 2450241

Summary:	rust-resctl-bench: tar-rs: Arbitrary directory permission modification via crafted tar archive
Product:	[Fedora] Fedora	Reporter:	Ben Beasley <code>
Component:	rust-resctl-bench	Assignee:	Rust SIG <rust-sig>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	davide, rust-sig
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	rust-resctl-bench-2.2.5-12.fc44 rust-resctl-bench-2.2.5-12.fc43 rust-resctl-bench-2.2.5-12.fc42 rust-resctl-bench-2.2.5-12.el9	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-03-31 14:47:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2450076
Bug Blocks:

Description Ben Beasley 2026-03-23 07:57:34 UTC

While rust-below wasn’t included in Red Hat prodsec’s mass bug filing for CVE-2026-33056, it does depend on rust-tar, and it’s possibly affected.

More information is available at https://www.cve.org/CVERecord?id=CVE-2026-33056. This flaw is fixed in version 0.4.45 of the tar crate. Updates for rust-tar-0.4.45 are in testing for all Fedora and EPEL branches, and buildroot overrides are active. All that’s required is therefore to rebuild the package.

Since rust-sig is a co-maintainer on this package, I would be happy to take care of rebuilding it and issuing updates, except that the package fails to build from source in Fedora 45/Rawhide, bug 2450076. Since whatever update caused the package to FTBFS is still in updates-testing for stable branches, I’m going to go ahead and push the rebuild commit and do the rebuilds in stable branches, but I obviously can’t rebuild Rawhide until the FTBFS is resolved.

Reproducible: Always

Comment 1 Ben Beasley 2026-03-23 07:58:28 UTC

(Also, I’m not going to try to do anything with EPEL8 and vendored dependencies.)

Comment 2 Fedora Update System 2026-03-23 16:49:45 UTC

FEDORA-2026-d7252cbfc9 (rust-resctl-bench-2.2.5-12.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d7252cbfc9

Comment 3 Fedora Update System 2026-03-23 16:50:34 UTC

FEDORA-2026-12baf239f8 (rust-resctl-bench-2.2.5-12.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-12baf239f8

Comment 4 Fedora Update System 2026-03-23 16:50:50 UTC

FEDORA-2026-dd42661781 (rust-resctl-bench-2.2.5-12.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-dd42661781

Comment 5 Fedora Update System 2026-03-23 16:51:11 UTC

FEDORA-EPEL-2026-d8dda8ca06 (rust-resctl-bench-2.2.5-12.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d8dda8ca06

Comment 6 Fedora Update System 2026-03-24 01:31:26 UTC

FEDORA-2026-12baf239f8 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-12baf239f8`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-12baf239f8

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-03-24 01:52:34 UTC

FEDORA-2026-d7252cbfc9 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d7252cbfc9`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d7252cbfc9

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2026-03-24 02:13:13 UTC

FEDORA-2026-dd42661781 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-dd42661781`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-dd42661781

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2026-03-25 00:40:38 UTC

FEDORA-EPEL-2026-d8dda8ca06 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-d8dda8ca06

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2026-03-31 14:47:11 UTC

FEDORA-2026-12baf239f8 (rust-resctl-bench-2.2.5-12.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 11 Fedora Update System 2026-04-01 00:57:13 UTC

FEDORA-2026-d7252cbfc9 (rust-resctl-bench-2.2.5-12.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 12 Fedora Update System 2026-04-01 01:09:12 UTC

FEDORA-2026-dd42661781 (rust-resctl-bench-2.2.5-12.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 13 Fedora Update System 2026-04-02 00:27:01 UTC

FEDORA-EPEL-2026-d8dda8ca06 (rust-resctl-bench-2.2.5-12.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.