[CLSA-2026:1783942375] Fix CVE(s): CVE-2026-33055
Type:
security
Severity:
Moderate
Release date:
2026-07-13 11:33:14 UTC
Description:
* SECURITY UPDATE: PAX size smuggling / parser type confusion in vendored tar crate - debian/patches/CVE-2026-33055.patch: unconditionally apply the PAX extended header size override in vendor/tar-0.4.44/src/archive.rs so a nonzero base header size no longer suppresses the PAX size, aligning parsing with Go's archive/tar and astral-tokio-tar and preventing hidden smuggled entries - CVE-2026-33055
CVEs fixed:
Updated packages:
  • cargo1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_amd64.deb
    sha:b44737fba1074165bf4af19a3e9e21e581c7c874
  • cargo1.88-doc_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:b9da933ccd2957fea88c12877759b7a3c8b067e6
  • libstd-rust1.88-1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_amd64.deb
    sha:8a609a636f56d8e82731d987c04098d64d4fc0a4
  • libstd-rust1.88-dev_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_amd64.deb
    sha:5e50edcacc92a574a4df038cf738fe476c2462e0
  • rust1.88-all_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:e72985b6bf6ccfe943ec73c7c0f684fb5b1353a4
  • rust1.88-analyzer_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_amd64.deb
    sha:67d3a5d85d8eca1b3681a607c7d1f7b471f7bfdf
  • rust1.88-clippy_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_amd64.deb
    sha:2f03277a44887c1c27da867f2483a066a03f3e82
  • rust1.88-doc_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:8829403920770706fb91e8317d8680689ec86c1e
  • rust1.88-gdb_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:058d8a4eb93d24aed9f683ab354774049e25ebd6
  • rust1.88-lldb_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:1a8ddf391a8f0cc26fb676f9c63437f2c9503417
  • rust1.88-llvm_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_amd64.deb
    sha:d7dd7110e1b98aa6f8f6c00cce4406edd6687033
  • rust1.88-src_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:2a7ad2fed7f7622da0ec8ff8731bc8667d54c8f9
  • rustc1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_amd64.deb
    sha:8d5af37b130b917de757fc6e7c67b2306f4db964
  • rustfmt1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_amd64.deb
    sha:99519ed4e33cee9cbb8760e421b364923c147275
  • cargo1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_arm64.deb
    sha:bc7b139432c09d3b8f11ed4c84c441ee0393f3b4
  • cargo1.88-doc_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:b9da933ccd2957fea88c12877759b7a3c8b067e6
  • libstd-rust1.88-1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_arm64.deb
    sha:2f984a16eb0adb3d8c7b6ee947ad6040e6cc4cd9
  • libstd-rust1.88-dev_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_arm64.deb
    sha:053d61bd831e2130800441708631b885c5582378
  • rust1.88-all_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:e72985b6bf6ccfe943ec73c7c0f684fb5b1353a4
  • rust1.88-analyzer_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_arm64.deb
    sha:df091fa3eb8d0311ad490a927ca0509d356415ac
  • rust1.88-clippy_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_arm64.deb
    sha:93eb7b5dad381322cb804174dbbda79aceb29fb4
  • rust1.88-doc_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:8829403920770706fb91e8317d8680689ec86c1e
  • rust1.88-gdb_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:058d8a4eb93d24aed9f683ab354774049e25ebd6
  • rust1.88-lldb_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:1a8ddf391a8f0cc26fb676f9c63437f2c9503417
  • rust1.88-llvm_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_arm64.deb
    sha:508d73962b2446e9e6d7fe5f8909ba5226bbc5be
  • rust1.88-src_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_all.deb
    sha:2a7ad2fed7f7622da0ec8ff8731bc8667d54c8f9
  • rustc1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_arm64.deb
    sha:d3e947b427c855844ba1f8f0bcd382f67ba23346
  • rustfmt1.88_1.88.0+dfsg1-2~bpo13+1+tuxcare.els6_arm64.deb
    sha:5a4ac14a0f21dd335b7a339da4d2d4e5da0c6122
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.