- Reported
-
- Issued
-
- Package
-
astral-tokio-tar
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#parser-differential
#smuggling
- Aliases
-
- References
-
- CVSS Score
- 8.1
HIGH
- CVSS Details
-
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Patched
-
Description
Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing
vulnerability that allows attackers to smuggle additional archive entries by
exploiting inconsistent PAX/ustar header handling. When processing archives with
PAX-extended headers containing size overrides, the parser incorrectly advances
stream position based on ustar header size (often zero) instead of the
PAX-specified size, causing it to interpret file content as legitimate tar
headers.
This vulnerability was disclosed to multiple Rust tar parsers, all derived from
the original async-tar fork of tar-rs.
For additional information see
Edera's blog post.
Advisory available under CC0-1.0
license.