[CLSA-2026:1791414839] Fix CVE(s): CVE-2026-33055
Type:
security
Severity:
Important
Release date:
2026-10-07 23:14:13 UTC
Description:
* SECURITY UPDATE: PAX size smuggling parsing differential in vendored tar crate - debian/patches/CVE-2026-33055.patch: unconditionally honor the PAX extended-header size in vendor/tar-0.4.43/src/archive.rs instead of only when the header size field is 0, so a crafted archive cannot hide entries (e.g. a smuggled symlink) behind a deflated header size that disagrees with other parsers - CVE-2026-33055
CVEs fixed:
Updated packages:
  • cargo1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:c927da654b1f6b4c5e63c5830e45528093ddb2bb
  • cargo1.86-doc_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:6e2e7efac9d7af0fbd1fc390a94df7cd84cc40cc
  • libstd-rust1.86-1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:53956207c7c7101442561354618d869be84ba250
  • libstd-rust1.86-dev_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:7d0b2e3ccf8bc4def63a718bf34b55077a77ed6f
  • rust1.86-all_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:96c1b83671bdf7846c696cb1f1c52d302983d400
  • rust1.86-analyzer_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:e68ff42ec23fd087f3f8c40bd6b438f77ba1cb25
  • rust1.86-clippy_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:4f6833bcbd7390f2082010351ef7d51e8c1c575a
  • rust1.86-doc_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:513e96f1aaeec5e0db801b353bc3498b499617af
  • rust1.86-gdb_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:fa966ccf990b08b42198a9ccca91997a4b69ae81
  • rust1.86-lldb_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:4791ee8963960db002da1e00f358fe9bef74b3eb
  • rust1.86-llvm_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:80aa5cfedf6df799e94cb8df01b0565687f6ed17
  • rust1.86-src_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:d49720a800d012a189dd3f8780418fae2ea2380b
  • rustc1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:e5a272f71986f2f8562516ca33114c27641f154d
  • rustfmt1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:4ddf3ab121257ce9b909b9cad963e29094a85d0e
  • cargo1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:2d613b76daa24e4302e4726d394f9d9449c2b21b
  • libstd-rust1.86-1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:2238b0536eaa4161627ddb998bd20bc689ede41f
  • libstd-rust1.86-dev_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:7ed4323e4088e27e146c7b9b9241302fa2a2f1d8
  • rust1.86-analyzer_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:9a4b9847de213e3d047bbb912740e74ff20557ae
  • rust1.86-clippy_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:15f90353853e26a0992d3e61999bf027acc78c4f
  • rust1.86-llvm_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:88bf69e314da76fdbb136f4f2df1715f65a6c44c
  • rustc1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:a20ef1e47926b6b45423a3c1427421e4cf0a9e8e
  • rustfmt1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:d53a97ac7531ae1c6970362f4b22a78861d94e3c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.