Red Hat Enterprise Linux 10/tar

Red Hat · Package

7 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
node-tar: Process crash via PAX numeric path type confusionCVE-2026-59871 · GHSA-W8WR-V893-VJVP	tar Confidential Compute Attestation/openshift-sandboxed-containers/osc-pccs	npmRed Hat	Medium	Fix reported	2026-09-10
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH	tar Confidential Compute Attestation/openshift-sandboxed-containers/osc-pccs	npmRed Hat	Medium	Fix reported	2026-09-10
node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsCVE-2026-59875 · GHSA-GVWX-54WH-QM9J	tar Confidential Compute Attestation/openshift-sandboxed-containers/osc-pccs	npmRed Hat	Medium	Fix reported	2026-09-10
tar-rs `unpack_in` can chmod arbitrary directories by following symlinksCVE-2026-33056 · GHSA-J4XF-2G29-59PHVersion ranges need review.	tar Confidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9	Rust / CargoRed Hat	Medium	Fix reported	2026-09-10
node-tar has a race condition leading to uninitialized memory exposureCVE-2025-64118 · GHSA-29XP-372Q-XQPH	tar Confidential Compute Attestation/openshift-sandboxed-containers/osc-pccs	npmRed Hat	Medium	Fix reported	2026-09-10
tar: does not properly warn the user when extracting setuid or setgid filesCVE-2005-2541	Red Hat Enterprise Linux 10/tar Red Hat Enterprise Linux 6/tar	Red Hat	Medium	No fix reported	Not recorded
tar: Incorrectly handled extension attributes in PAX archives can lead to a crashCVE-2023-39804	Red Hat Enterprise Linux 10/tar Red Hat Enterprise Linux 6/tar	Red Hat	Low	No fix reported	Not recorded