[Bug 2145764] Re: CVE-2026-33056: Vendored tar crate can chmod arbitrary directories by following symlinks

Tue Apr 7 14:53:24 UTC 2026

I published a patch for rustc-1.62 (1.62.1+dfsg1-1ubuntu0.22.04.2) on
Jammy in a PPA:
https://launchpad.net/~ruancomelli/+archive/ubuntu/rustc-1.62-release-
pocket-only-2/+sourcepub/18287875/+listing-archive-extra

Note that this PPA is set up to depend only on released dependencies
("Basic" dependencies), and NOT on -security ("Security") or -updates
("Default"). This is because the -security and -updates pockets contain
a newer version of cargo that gets pulled in during the build. This
newer cargo version is incompatible with rustc-1.62, causing a build
failure. By picking only the released dependencies, we ensure that the
cargo version that is used is compatible with rustc-1.62.

Also note that the self-build autopkgtest is still failing due to the
same reason. I will soon upload a new version
(1.62.1+dfsg1-1ubuntu0.22.04.3) with that autopkgtest removed, but
22.04.2 can already be uploaded if this autopkgtest is not required to
pass.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rustc in Ubuntu.
Matching subscriptions: rustc-1.93
https://bugs.launchpad.net/bugs/2145764

Title:
  CVE-2026-33056: Vendored tar crate can chmod arbitrary directories by
  following symlinks

Status in cargo package in Ubuntu:
  New
Status in rust-astral-tokio-tar package in Ubuntu:
  New
Status in rust-async-tar package in Ubuntu:
  New
Status in rust-cargo-c package in Ubuntu:
  Fix Released
Status in rust-tar package in Ubuntu:
  Fix Released
Status in rustc package in Ubuntu:
  New
Status in rustc-1.62 package in Ubuntu:
  In Progress
Status in rustc-1.74 package in Ubuntu:
  New
Status in rustc-1.76 package in Ubuntu:
  New
Status in rustc-1.77 package in Ubuntu:
  New
Status in rustc-1.78 package in Ubuntu:
  New
Status in rustc-1.79 package in Ubuntu:
  New
Status in rustc-1.80 package in Ubuntu:
  New
Status in rustc-1.81 package in Ubuntu:
  New
Status in rustc-1.82 package in Ubuntu:
  New
Status in rustc-1.83 package in Ubuntu:
  New
Status in rustc-1.84 package in Ubuntu:
  New
Status in rustc-1.85 package in Ubuntu:
  New
Status in rustc-1.88 package in Ubuntu:
  New
Status in rustc-1.89 package in Ubuntu:
  New
Status in rustc-1.91 package in Ubuntu:
  Fix Released
Status in rustc-1.92 package in Ubuntu:
  Fix Released
Status in rustc-1.93 package in Ubuntu:
  Fix Released
Status in cargo source package in Focal:
  New
Status in rust-astral-tokio-tar source package in Focal:
  New
Status in rust-async-tar source package in Focal:
  New
Status in rust-tar source package in Focal:
  Fix Committed
Status in rustc source package in Focal:
  New
Status in rustc-1.76 source package in Focal:
  Fix Committed
Status in rustc-1.77 source package in Focal:
  Fix Committed
Status in rustc-1.78 source package in Focal:
  New
Status in rustc-1.79 source package in Focal:
  New
Status in rustc-1.80 source package in Focal:
  New
Status in cargo source package in Jammy:
  New
Status in rust-tar source package in Jammy:
  Fix Released
Status in rustc source package in Jammy:
  New
Status in rustc-1.62 source package in Jammy:
  In Progress
Status in rustc-1.76 source package in Jammy:
  In Progress
Status in rustc-1.77 source package in Jammy:
  In Progress
Status in rustc-1.78 source package in Jammy:
  New
Status in rustc-1.79 source package in Jammy:
  New
Status in rustc-1.80 source package in Jammy:
  New
Status in rustc-1.81 source package in Jammy:
  New
Status in rustc-1.82 source package in Jammy:
  New
Status in rustc-1.83 source package in Jammy:
  New
Status in rustc-1.84 source package in Jammy:
  New
Status in rustc-1.85 source package in Jammy:
  New
Status in rustc-1.89 source package in Jammy:
  New
Status in cargo source package in Noble:
  New
Status in rust-async-tar source package in Noble:
  New
Status in rust-cargo-c source package in Noble:
  Triaged
Status in rust-tar source package in Noble:
  Fix Released
Status in rustc source package in Noble:
  New
Status in rustc-1.74 source package in Noble:
  In Progress
Status in rustc-1.76 source package in Noble:
  In Progress
Status in rustc-1.77 source package in Noble:
  In Progress
Status in rustc-1.78 source package in Noble:
  New
Status in rustc-1.79 source package in Noble:
  New
Status in rustc-1.80 source package in Noble:
  New
Status in rustc-1.81 source package in Noble:
  New
Status in rustc-1.82 source package in Noble:
  New
Status in rustc-1.83 source package in Noble:
  New
Status in rustc-1.84 source package in Noble:
  New
Status in rustc-1.85 source package in Noble:
  New
Status in rustc-1.89 source package in Noble:
  New
Status in rustc-1.91 source package in Noble:
  New
Status in rust-async-tar source package in Questing:
  New
Status in rust-cargo-c source package in Questing:
  Fix Released
Status in rust-tar source package in Questing:
  Fix Released
Status in rustc-1.85 source package in Questing:
  New
Status in rustc-1.88 source package in Questing:
  New
Status in rust-cargo-c source package in Resolute:
  Fix Released
Status in rust-tar source package in Resolute:
  Fix Released
Status in rustc-1.91 source package in Resolute:
  Fix Released
Status in rustc-1.92 source package in Resolute:
  Fix Released
Status in rustc-1.93 source package in Resolute:
  Fix Released

Bug description:
  CVE record: https://www.cve.org/CVERecord?id=CVE-2026-33056

  Rust packages which vendor tar-rs 0.4.44 and below bundle in a
  vulnerability which allows malicious crates to change the
  permissions on arbitrary directories.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cargo/+bug/2145764/+subscriptions