From bad2ef51ac8dac2928be16fd7e38f8a1599feb67 Mon Sep 17 00:00:00 2001 From: Pavel Cahyna Date: Mon, 24 Aug 2026 15:03:08 +0200 Subject: [PATCH] Bump Release, update %changelog Resolves: RHEL-234449 --- tar.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tar.spec b/tar.spec index 58556f4..a7c45e6 100644 --- a/tar.spec +++ b/tar.spec @@ -5,7 +5,7 @@ Summary: GNU file archiving program Name: tar Epoch: 2 Version: 1.34 -Release: 12%{?dist} +Release: 13%{?dist} License: GPLv3+ URL: https://www.gnu.org/software/tar/ @@ -172,6 +172,14 @@ make check || ( %changelog +* Mon Aug 24 2026 Pavel Cahyna - 2:1.34-13 +- Backport upstream patches for CVE-2026-18477, fixes a bug + where incremental restore with cyclic renames between backups + may create a temporary directory at an archive-controlled path + outside the extraction tree. + The fix for CVE-2025-45582 already prevents exploiting + this problem, so it is more a correctness and hardening change. + * Fri Aug 21 2026 Pavel Cahyna - 2:1.34-12 - Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) - Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)