From e87b5ccaf5f4c6f2729d8813ec56ce1616d36047 Mon Sep 17 00:00:00 2001 From: Pavel Cahyna Date: Fri, 21 Aug 2026 21:10:42 +0200 Subject: [PATCH] Bump Release, update %changelog Resolves: RHEL-144021 Resolves: RHEL-223957 Resolves: RHEL-219212 --- tar.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/tar.spec b/tar.spec index 7fe2ef5..2afb82e 100644 --- a/tar.spec +++ b/tar.spec @@ -5,7 +5,7 @@ Summary: GNU file archiving program Name: tar Epoch: 2 Version: 1.34 -Release: 11%{?dist} +Release: 12%{?dist} License: GPLv3+ URL: https://www.gnu.org/software/tar/ @@ -167,6 +167,12 @@ make check || ( %changelog +* Fri Aug 21 2026 Pavel Cahyna - 2:1.34-12 +- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t) +- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix) + Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks). +- Upstream fix for build with libacl 2.4.0 + * Mon Feb 23 2026 Pavel Cahyna - 2:1.34-11 - Add upstream patch to improve error message for --one-top-level with absolute path (unsupported as a result of CVE-2025-45582 fix)