This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-38511 →

DEBIAN-CVE-2021-38511

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directori...

Original description

The description as published by the source.

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rust-tar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.37-1"}]}]

Debian:13 rust-tar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.37-1"}]}]

Debian:14 rust-tar

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.37-1"}]}]

References

advisory security-tracker.debian.org