From fa57991f9dec3a24f01d0f2c001d7eca2daccae0 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 3 Aug 2026 08:52:34 +0000 Subject: [PATCH] Fix CVE-2026-9538: cap per-entry declared size to prevent memory DoS Backport upstream commit f9af0142 to perl-Archive-Tar 2.38 to fix CVE-2026-9538. The patch adds a $MAX_FILE_SIZE variable (default 1 GiB) that caps the per-entry declared size accepted when reading an archive, preventing memory DoS from attacker-controlled tar header size fields. CVE: CVE-2026-9538 Upstream patches: - https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch Resolves: RHEL-191916 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- perl-Archive-Tar-2.38-CVE-2026-9538.patch | 72 +++++++++++++++++++++++ perl-Archive-Tar.spec | 11 +++- 2 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 perl-Archive-Tar-2.38-CVE-2026-9538.patch diff --git a/perl-Archive-Tar-2.38-CVE-2026-9538.patch b/perl-Archive-Tar-2.38-CVE-2026-9538.patch new file mode 100644 index 0000000..a4f90c5 --- /dev/null +++ b/perl-Archive-Tar-2.38-CVE-2026-9538.patch @@ -0,0 +1,72 @@ +From 9e7c956f8af21f6eb65974a0c54a8a0fd61564d0 Mon Sep 17 00:00:00 2001 +From: Stig Palmquist +Date: Mon, 25 May 2026 19:11:34 +0100 +Subject: [PATCH] Cpan entry size during read + +Cap entry size during read to defend against attacker-controlled +size-field memory DoS + +The tar header's 12-byte size field is attacker-controlled. Archive::Tar's +non-skip extract path at Tar.pm:501 allocates a Perl scalar of the declared +size before returning the read-short error, allowing a few-KB compressed +archive declaring a 100 GB inner entry to trigger immediate multi-GB +allocation. The existing $EXTRACT_BLOCK_SIZE is an output-side syswrite +chunk size, not an input cap. + +Add $MAX_FILE_SIZE (default 1 GiB) checked once per entry, gating both the +chunked-skip and full-slurp branches. Set to 0 to disable the cap. + +Signed-off-by: Chris 'BinGOs' Williams +--- + lib/Archive/Tar.pm | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/lib/Archive/Tar.pm b/lib/Archive/Tar.pm +index 7335d24..fe52677 100644 +--- a/lib/Archive/Tar.pm ++++ b/lib/Archive/Tar.pm +@@ -24,6 +24,7 @@ use strict; + use vars qw[$DEBUG $error $VERSION $WARN $FOLLOW_SYMLINK $CHOWN $CHMOD + $DO_NOT_USE_PREFIX $HAS_PERLIO $HAS_IO_STRING $SAME_PERMISSIONS + $INSECURE_EXTRACT_MODE $ZERO_PAD_NUMBERS @ISA @EXPORT $RESOLVE_SYMLINK ++ $MAX_FILE_SIZE + ]; + + @ISA = qw[Exporter]; +@@ -39,6 +40,7 @@ $DO_NOT_USE_PREFIX = 0; + $INSECURE_EXTRACT_MODE = 0; + $ZERO_PAD_NUMBERS = 0; + $RESOLVE_SYMLINK = $ENV{'PERL5_AT_RESOLVE_SYMLINK'} || 'speed'; ++$MAX_FILE_SIZE = 1024 * 1024 * 1024; + + BEGIN { + use Config; +@@ -442,6 +444,14 @@ sub _read_tar { + + my $block = BLOCK_SIZE->( $entry->size ); + ++ if ( $MAX_FILE_SIZE && $entry->size > $MAX_FILE_SIZE ) { ++ $self->_error( qq[Entry '] . $entry->full_path . ++ qq[' declared size ] . $entry->size . ++ qq[ bytes exceeds \$Archive::Tar::MAX_FILE_SIZE ] . ++ qq[($MAX_FILE_SIZE); refusing to allocate] ); ++ next LOOP; ++ } ++ + $data = $entry->get_content_by_ref; + + my $skip = 0; +@@ -2194,6 +2204,13 @@ numbers. Added for compatibility with C implementations. + + It won't work for terminal, pipe or sockets or every non seekable source. + ++=head2 $Archive::Tar::MAX_FILE_SIZE ++ ++This variable holds an upper bound on the per-entry declared size that ++C will accept when reading an archive. Entries whose header ++claims a larger size are refused with an error before any read allocation. ++Defaults to 1 GiB. Set to 0 to disable the cap. ++ + =cut + + =head1 FAQ diff --git a/perl-Archive-Tar.spec b/perl-Archive-Tar.spec index c5b771c..91d9934 100644 --- a/perl-Archive-Tar.spec +++ b/perl-Archive-Tar.spec @@ -7,7 +7,7 @@ Name: perl-Archive-Tar Version: 2.38 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A module for Perl manipulation of .tar files License: GPL+ or Artistic URL: https://metacpan.org/release/Archive-Tar @@ -18,6 +18,9 @@ Patch0: Archive-Tar-2.02-Do-not-sleep-in-Makefile.PL.patch # https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158 # https://github.com/jib/archive-tar-new/commit/484f71ea0189ed46690f50dc7ee71d4b8bc0e70f Patch1: perl-Archive-Tar-2.38-RHEL-181658.patch +# https://issues.redhat.com/browse/RHEL-191916 +# https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7 +Patch2: perl-Archive-Tar-2.38-CVE-2026-9538.patch BuildArch: noarch # Most of the BRS are needed only for tests, compression support at run-time # is optional soft dependency. @@ -102,6 +105,7 @@ will also support compressed or gzipped tar files. %setup -q -n Archive-Tar-%{version} %patch0 -p1 -b .orig %patch1 -p1 +%patch2 -p1 %build perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1 @@ -123,6 +127,11 @@ make test %changelog +* Mon Aug 03 2026 RHEL Packaging Agent - 2.38-8 +- Fix memory DoS from attacker-controlled tar header size fields + (CVE-2026-9538) + Related: RHEL-191916 + * Wed Jul 29 2026 RHEL Packaging Agent - 2.38-7 - Fix symlink and hardlink path traversal in secure extract mode (CVE-2026-42496)