[Bug 2145764] Re: CVE-2026-33056: Vendored tar crate can chmod arbitrary directories by following symlinks

[Petrichor Park]

For posterity: the bugs that affect Focal are fixed for ESM customers,
but not for normal users. They are marked as fixed here but unless you
have ESM you won't get the update.

** Changed in: rustc-1.80 (Ubuntu Focal)
       Status: New => Fix Released

** Changed in: rustc-1.79 (Ubuntu Focal)
       Status: New => Fix Released

** Changed in: rustc-1.78 (Ubuntu Focal)
       Status: New => Fix Released

** Changed in: rustc (Ubuntu Focal)
       Status: New => Fix Released

** Changed in: rustc (Ubuntu)
       Status: New => Fix Released

** Changed in: rustc-1.78 (Ubuntu)
       Status: New => Fix Released

** Changed in: rustc-1.79 (Ubuntu)
       Status: New => Fix Released

** Changed in: rustc-1.80 (Ubuntu)
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to rustc in Ubuntu.
Matching subscriptions: rustc-1.93
https://bugs.launchpad.net/bugs/2145764

Title:
  CVE-2026-33056: Vendored tar crate can chmod arbitrary directories by
  following symlinks

Status in rust-cargo-c package in Ubuntu:
  Fix Released
Status in rust-tar package in Ubuntu:
  Fix Released
Status in rustc package in Ubuntu:
  Fix Released
Status in rustc-1.62 package in Ubuntu:
  Fix Released
Status in rustc-1.74 package in Ubuntu:
  Fix Released
Status in rustc-1.76 package in Ubuntu:
  Fix Released
Status in rustc-1.77 package in Ubuntu:
  Fix Released
Status in rustc-1.78 package in Ubuntu:
  Fix Released
Status in rustc-1.79 package in Ubuntu:
  Fix Released
Status in rustc-1.80 package in Ubuntu:
  Fix Released
Status in rustc-1.81 package in Ubuntu:
  Fix Released
Status in rustc-1.82 package in Ubuntu:
  Fix Released
Status in rustc-1.83 package in Ubuntu:
  Fix Released
Status in rustc-1.84 package in Ubuntu:
  Fix Released
Status in rustc-1.85 package in Ubuntu:
  Fix Released
Status in rustc-1.88 package in Ubuntu:
  Fix Released
Status in rustc-1.89 package in Ubuntu:
  Fix Released
Status in rustc-1.91 package in Ubuntu:
  Fix Released
Status in rustc-1.92 package in Ubuntu:
  Fix Released
Status in rustc-1.93 package in Ubuntu:
  Fix Released
Status in rust-tar source package in Focal:
  Fix Released
Status in rustc source package in Focal:
  Fix Released
Status in rustc-1.76 source package in Focal:
  Fix Released
Status in rustc-1.77 source package in Focal:
  Fix Released
Status in rustc-1.78 source package in Focal:
  Fix Released
Status in rustc-1.79 source package in Focal:
  Fix Released
Status in rustc-1.80 source package in Focal:
  Fix Released
Status in rust-tar source package in Jammy:
  Fix Released
Status in rustc source package in Jammy:
  Fix Released
Status in rustc-1.62 source package in Jammy:
  Fix Released
Status in rustc-1.76 source package in Jammy:
  Fix Released
Status in rustc-1.77 source package in Jammy:
  Fix Released
Status in rustc-1.78 source package in Jammy:
  Fix Released
Status in rustc-1.79 source package in Jammy:
  Fix Released
Status in rustc-1.80 source package in Jammy:
  Fix Released
Status in rustc-1.81 source package in Jammy:
  Fix Released
Status in rustc-1.82 source package in Jammy:
  Fix Released
Status in rustc-1.83 source package in Jammy:
  Fix Released
Status in rustc-1.84 source package in Jammy:
  Fix Released
Status in rustc-1.85 source package in Jammy:
  Fix Released
Status in rustc-1.89 source package in Jammy:
  Fix Released
Status in rust-cargo-c source package in Noble:
  Triaged
Status in rust-tar source package in Noble:
  Fix Released
Status in rustc source package in Noble:
  Fix Released
Status in rustc-1.74 source package in Noble:
  Fix Released
Status in rustc-1.76 source package in Noble:
  Fix Released
Status in rustc-1.77 source package in Noble:
  Fix Released
Status in rustc-1.78 source package in Noble:
  Fix Released
Status in rustc-1.79 source package in Noble:
  Fix Released
Status in rustc-1.80 source package in Noble:
  Fix Released
Status in rustc-1.81 source package in Noble:
  Fix Released
Status in rustc-1.82 source package in Noble:
  Fix Released
Status in rustc-1.83 source package in Noble:
  Fix Released
Status in rustc-1.84 source package in Noble:
  Fix Released
Status in rustc-1.85 source package in Noble:
  Fix Released
Status in rustc-1.89 source package in Noble:
  Fix Released
Status in rustc-1.91 source package in Noble:
  Fix Released
Status in rust-cargo-c source package in Questing:
  Fix Released
Status in rust-tar source package in Questing:
  Fix Released
Status in rustc-1.85 source package in Questing:
  Fix Released
Status in rustc-1.88 source package in Questing:
  Fix Released
Status in rust-cargo-c source package in Resolute:
  Fix Released
Status in rust-tar source package in Resolute:
  Fix Released
Status in rustc-1.91 source package in Resolute:
  Fix Released
Status in rustc-1.92 source package in Resolute:
  Fix Released
Status in rustc-1.93 source package in Resolute:
  Fix Released

Bug description:
  CVE record: https://www.cve.org/CVERecord?id=CVE-2026-33056

  Rust packages which vendor tar-rs 0.4.44 and below bundle in a
  vulnerability which allows malicious crates to change the
  permissions on arbitrary directories.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/rust-cargo-c/+bug/2145764/+subscriptions