[Bug 2145764] Re: CVE-2026-33056: Vendored tar crate can chmod arbitrary directories by following symlinks

Thu Apr 9 12:45:01 UTC 2026

This bug was fixed in the package rustc-1.81 -
1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1

---------------
rustc-1.81 (1.81.0+dfsg0ubuntu0-0ubuntu0.22.04.1) jammy; urgency=medium

  * d/p/upstream/u-tar-cve-2026-33056: fix vulnerability (LP: #2145764)

 -- Petrichor Park <petrichor.park at canonical.com>  Tue, 24 Mar 2026
09:36:29 -0500

** Changed in: rustc-1.81 (Ubuntu Jammy)
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rustc in Ubuntu.
Matching subscriptions: rustc-1.93
https://bugs.launchpad.net/bugs/2145764

Title:
  CVE-2026-33056: Vendored tar crate can chmod arbitrary directories by
  following symlinks

Status in cargo package in Ubuntu:
  New
Status in rust-astral-tokio-tar package in Ubuntu:
  New
Status in rust-async-tar package in Ubuntu:
  New
Status in rust-cargo-c package in Ubuntu:
  Fix Released
Status in rust-tar package in Ubuntu:
  Fix Released
Status in rustc package in Ubuntu:
  New
Status in rustc-1.62 package in Ubuntu:
  In Progress
Status in rustc-1.74 package in Ubuntu:
  New
Status in rustc-1.76 package in Ubuntu:
  New
Status in rustc-1.77 package in Ubuntu:
  New
Status in rustc-1.78 package in Ubuntu:
  New
Status in rustc-1.79 package in Ubuntu:
  New
Status in rustc-1.80 package in Ubuntu:
  New
Status in rustc-1.81 package in Ubuntu:
  New
Status in rustc-1.82 package in Ubuntu:
  New
Status in rustc-1.83 package in Ubuntu:
  New
Status in rustc-1.84 package in Ubuntu:
  New
Status in rustc-1.85 package in Ubuntu:
  New
Status in rustc-1.88 package in Ubuntu:
  New
Status in rustc-1.89 package in Ubuntu:
  New
Status in rustc-1.91 package in Ubuntu:
  Fix Released
Status in rustc-1.92 package in Ubuntu:
  Fix Released
Status in rustc-1.93 package in Ubuntu:
  Fix Released
Status in cargo source package in Focal:
  New
Status in rust-astral-tokio-tar source package in Focal:
  New
Status in rust-async-tar source package in Focal:
  New
Status in rust-tar source package in Focal:
  Fix Committed
Status in rustc source package in Focal:
  New
Status in rustc-1.76 source package in Focal:
  Fix Committed
Status in rustc-1.77 source package in Focal:
  Fix Committed
Status in rustc-1.78 source package in Focal:
  New
Status in rustc-1.79 source package in Focal:
  New
Status in rustc-1.80 source package in Focal:
  New
Status in cargo source package in Jammy:
  New
Status in rust-tar source package in Jammy:
  Fix Released
Status in rustc source package in Jammy:
  Fix Released
Status in rustc-1.62 source package in Jammy:
  Fix Released
Status in rustc-1.76 source package in Jammy:
  Fix Released
Status in rustc-1.77 source package in Jammy:
  Fix Released
Status in rustc-1.78 source package in Jammy:
  New
Status in rustc-1.79 source package in Jammy:
  Fix Released
Status in rustc-1.80 source package in Jammy:
  Fix Released
Status in rustc-1.81 source package in Jammy:
  Fix Released
Status in rustc-1.82 source package in Jammy:
  Fix Released
Status in rustc-1.83 source package in Jammy:
  Fix Released
Status in rustc-1.84 source package in Jammy:
  Fix Released
Status in rustc-1.85 source package in Jammy:
  New
Status in rustc-1.89 source package in Jammy:
  Fix Released
Status in cargo source package in Noble:
  New
Status in rust-async-tar source package in Noble:
  New
Status in rust-cargo-c source package in Noble:
  Triaged
Status in rust-tar source package in Noble:
  Fix Released
Status in rustc source package in Noble:
  Fix Released
Status in rustc-1.74 source package in Noble:
  Fix Released
Status in rustc-1.76 source package in Noble:
  Fix Released
Status in rustc-1.77 source package in Noble:
  Fix Released
Status in rustc-1.78 source package in Noble:
  New
Status in rustc-1.79 source package in Noble:
  Fix Released
Status in rustc-1.80 source package in Noble:
  Fix Released
Status in rustc-1.81 source package in Noble:
  Fix Released
Status in rustc-1.82 source package in Noble:
  Fix Released
Status in rustc-1.83 source package in Noble:
  Fix Released
Status in rustc-1.84 source package in Noble:
  Fix Released
Status in rustc-1.85 source package in Noble:
  New
Status in rustc-1.89 source package in Noble:
  Fix Released
Status in rustc-1.91 source package in Noble:
  New
Status in rust-async-tar source package in Questing:
  New
Status in rust-cargo-c source package in Questing:
  Fix Released
Status in rust-tar source package in Questing:
  Fix Released
Status in rustc-1.85 source package in Questing:
  New
Status in rustc-1.88 source package in Questing:
  Fix Released
Status in rust-cargo-c source package in Resolute:
  Fix Released
Status in rust-tar source package in Resolute:
  Fix Released
Status in rustc-1.91 source package in Resolute:
  Fix Released
Status in rustc-1.92 source package in Resolute:
  Fix Released
Status in rustc-1.93 source package in Resolute:
  Fix Released

Bug description:
  CVE record: https://www.cve.org/CVERecord?id=CVE-2026-33056

  Rust packages which vendor tar-rs 0.4.44 and below bundle in a
  vulnerability which allows malicious crates to change the
  permissions on arbitrary directories.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cargo/+bug/2145764/+subscriptions