rpms/perl-Archive-Tar
7
0
Fork 0
Code Issues Pull Requests Releases Activity
A module for Perl manipulation of .tar files
143 Commits 27 Branches 32 Tags 227 KiB
3af7e02570
Go to file
RHEL Packaging Agent 3af7e02570 Fix CVE-2026-42496 in perl-Archive-Tar (symlink/hardlink validation) 
Backport two upstream commits to fix symlink and hardlink
path traversal vulnerabilities in Archive::Tar's secure
extract mode (CVE-2026-42496, CVE-2026-42497).

The first commit adds validation of symlink and hardlink
link targets, rejecting absolute paths and directory
traversal via '..' components. The second commit fixes a
regression where valid in-tree symlinks containing '..'
were incorrectly rejected, by using the existing
_symlinks_resolver() function with a new strict parameter.

CVE: CVE-2026-42496 CVE-2026-42497
Upstream patches:
 - 17c873492a.patch
 - 484f71ea01.patch
Resolves: RHEL-181653

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-07-29 10:02:33 +00:00
.fmf Package tests 2021-08-02 10:12:02 +02:00
plans Update tests and gating.yaml 2024-07-08 17:31:50 +02:00
tests Update tests and gating.yaml 2024-07-08 17:21:52 +02:00
.gitignore 3.02 bump 2023-04-13 15:23:28 +02:00
Archive-Tar-2.02-Do-not-sleep-in-Makefile.PL.patch 2.36 bump 2020-02-03 09:19:57 +01:00
gating.yaml Update tests and gating.yaml 2024-07-08 17:21:52 +02:00
perl-Archive-Tar-3.02-RHEL-181653.patch Fix CVE-2026-42496 in perl-Archive-Tar (symlink/hardlink validation) 2026-07-29 10:02:33 +00:00
perl-Archive-Tar.rpmlintrc 2.38 bump 2020-06-25 11:42:53 +02:00
perl-Archive-Tar.spec Fix CVE-2026-42496 in perl-Archive-Tar (symlink/hardlink validation) 2026-07-29 10:02:33 +00:00
sources 3.02 bump 2023-04-13 15:23:28 +02:00