[Bug 2145764] Re: CVE-2026-33056: Vendored tar crate can chmod arbitrary directories by following symlinks

Mon Apr 13 12:12:13 UTC 2026

This bug was fixed in the package rustc-1.85 -
1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2

---------------
rustc-1.85 (1.85.1+dfsg0ubuntu2~bpo0-0ubuntu0.24.04.2) noble; urgency=medium

  * d/p/upstream/u-tar-cve-2026-33056: Fix vulnerability (LP: #2145764)
  * d/rules: Fix FTBFS by excluding librustc_driver from DWARF optimisation

 -- Max Gilmour <max.gilmour at canonical.com>  Wed, 25 Mar 2026 13:20:01
-0700

** Changed in: rustc-1.91 (Ubuntu Noble)
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rustc in Ubuntu.
Matching subscriptions: rustc-1.93
https://bugs.launchpad.net/bugs/2145764

Title:
  CVE-2026-33056: Vendored tar crate can chmod arbitrary directories by
  following symlinks

Status in rust-cargo-c package in Ubuntu:
  Fix Released
Status in rust-tar package in Ubuntu:
  Fix Released
Status in rustc package in Ubuntu:
  New
Status in rustc-1.62 package in Ubuntu:
  In Progress
Status in rustc-1.74 package in Ubuntu:
  New
Status in rustc-1.76 package in Ubuntu:
  New
Status in rustc-1.77 package in Ubuntu:
  New
Status in rustc-1.78 package in Ubuntu:
  New
Status in rustc-1.79 package in Ubuntu:
  New
Status in rustc-1.80 package in Ubuntu:
  New
Status in rustc-1.81 package in Ubuntu:
  New
Status in rustc-1.82 package in Ubuntu:
  New
Status in rustc-1.83 package in Ubuntu:
  New
Status in rustc-1.84 package in Ubuntu:
  New
Status in rustc-1.85 package in Ubuntu:
  New
Status in rustc-1.88 package in Ubuntu:
  New
Status in rustc-1.89 package in Ubuntu:
  New
Status in rustc-1.91 package in Ubuntu:
  Fix Released
Status in rustc-1.92 package in Ubuntu:
  Fix Released
Status in rustc-1.93 package in Ubuntu:
  Fix Released
Status in rust-tar source package in Focal:
  Fix Committed
Status in rustc source package in Focal:
  New
Status in rustc-1.76 source package in Focal:
  Fix Committed
Status in rustc-1.77 source package in Focal:
  Fix Committed
Status in rustc-1.78 source package in Focal:
  New
Status in rustc-1.79 source package in Focal:
  New
Status in rustc-1.80 source package in Focal:
  New
Status in rust-tar source package in Jammy:
  Fix Released
Status in rustc source package in Jammy:
  Fix Released
Status in rustc-1.62 source package in Jammy:
  Fix Released
Status in rustc-1.76 source package in Jammy:
  Fix Released
Status in rustc-1.77 source package in Jammy:
  Fix Released
Status in rustc-1.78 source package in Jammy:
  Fix Released
Status in rustc-1.79 source package in Jammy:
  Fix Released
Status in rustc-1.80 source package in Jammy:
  Fix Released
Status in rustc-1.81 source package in Jammy:
  Fix Released
Status in rustc-1.82 source package in Jammy:
  Fix Released
Status in rustc-1.83 source package in Jammy:
  Fix Released
Status in rustc-1.84 source package in Jammy:
  Fix Released
Status in rustc-1.85 source package in Jammy:
  Fix Released
Status in rustc-1.89 source package in Jammy:
  Fix Released
Status in rust-cargo-c source package in Noble:
  Triaged
Status in rust-tar source package in Noble:
  Fix Released
Status in rustc source package in Noble:
  Fix Released
Status in rustc-1.74 source package in Noble:
  Fix Released
Status in rustc-1.76 source package in Noble:
  Fix Released
Status in rustc-1.77 source package in Noble:
  Fix Released
Status in rustc-1.78 source package in Noble:
  Fix Released
Status in rustc-1.79 source package in Noble:
  Fix Released
Status in rustc-1.80 source package in Noble:
  Fix Released
Status in rustc-1.81 source package in Noble:
  Fix Released
Status in rustc-1.82 source package in Noble:
  Fix Released
Status in rustc-1.83 source package in Noble:
  Fix Released
Status in rustc-1.84 source package in Noble:
  Fix Released
Status in rustc-1.85 source package in Noble:
  Fix Released
Status in rustc-1.89 source package in Noble:
  Fix Released
Status in rustc-1.91 source package in Noble:
  Fix Released
Status in rust-cargo-c source package in Questing:
  Fix Released
Status in rust-tar source package in Questing:
  Fix Released
Status in rustc-1.85 source package in Questing:
  Fix Released
Status in rustc-1.88 source package in Questing:
  Fix Released
Status in rust-cargo-c source package in Resolute:
  Fix Released
Status in rust-tar source package in Resolute:
  Fix Released
Status in rustc-1.91 source package in Resolute:
  Fix Released
Status in rustc-1.92 source package in Resolute:
  Fix Released
Status in rustc-1.93 source package in Resolute:
  Fix Released

Bug description:
  CVE record: https://www.cve.org/CVERecord?id=CVE-2026-33056

  Rust packages which vendor tar-rs 0.4.44 and below bundle in a
  vulnerability which allows malicious crates to change the
  permissions on arbitrary directories.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rust-cargo-c/+bug/2145764/+subscriptions