rpms/tar
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Bump Release, update %changelog

Browse Source 
Resolves: RHEL-234448
This commit is contained in:
Pavel Cahyna 2026-08-24 15:03:08 +02:00
parent decebd3bbe
commit 4d1cf8cecb
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
tar.spec
View File

@ -10,7 +10,7 @@ Summary: GNU file archiving program
Name: tar
Epoch: 2
Version: 1.35
Release: 12%{?dist}
Release: 13%{?dist}
License: GPL-3.0-or-later
URL: https://www.gnu.org/software/tar/
@ -183,6 +183,14 @@ make check || (
%changelog
* Mon Aug 24 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-13
- Backport upstream patches for CVE-2026-18477, fixes a bug
where incremental restore with cyclic renames between backups
may create a temporary directory at an archive-controlled path
outside the extraction tree.
The fix for CVE-2025-45582 already prevents exploiting
this problem, so it is more a correctness and hardening change.
* Fri Aug 21 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-12
- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)
- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)