[CLSA-2026:1791413390] Fix CVE(s): CVE-2026-33055
Type:
security
Severity:
Important
Release date:
2026-10-07 22:50:04 UTC
Description:
* SECURITY UPDATE: PAX size smuggling parsing differential in vendored tar crate - debian/patches/CVE-2026-33055.patch: unconditionally honor the PAX extended-header size in vendor/tar-0.4.43/src/archive.rs instead of only when the header size field is 0, so a crafted archive cannot hide entries (e.g. a smuggled symlink) behind a deflated header size that disagrees with other parsers - CVE-2026-33055
CVEs fixed:
Updated packages:
  • cargo1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:d23d3c5edfec8d9d9b436e19b94e1467e2af6d9a
  • cargo1.86-doc_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:ef82455f67febe7d2188ae0af9edca5e799cba43
  • libstd-rust1.86-1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:0c445a4d62f157298c38d5f294823234d3d255b1
  • libstd-rust1.86-dev_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:dabfcc7e6b46335c8046af392ac377957216a237
  • rust1.86-all_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:e79e4f8540236ff42663891c060b087fb3916751
  • rust1.86-analyzer_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:4a9ecc8d45fb3be526368394a7792840963b3e94
  • rust1.86-clippy_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:ba1ea0dd7df14aa36454d9d0305d69f8e607649f
  • rust1.86-doc_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:2312f699db69fef5936d96e5e46f30c9c564fb0b
  • rust1.86-gdb_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:5c6f3108d5034161ef999533570c5cc2ea801291
  • rust1.86-lldb_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:920935619916817659a04e1d0ea72b27158df716
  • rust1.86-llvm_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:477d51921ffff1349b0079cd3146bea22e87aa89
  • rust1.86-src_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_all.deb
    sha:1500bf832a8875b6115bcf7c8c78d4dc15c33340
  • rustc1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:83d644d35a2a5f01ad40b4477035c5bfe274eda9
  • rustfmt1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_amd64.deb
    sha:5a8cb219218318dd5f4df2655f3cfaffb9a2883f
  • cargo1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:f38dc586e7ec7b03a1457f9722e12c62255416bb
  • libstd-rust1.86-1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:c059104b3ff356eac886c9c8bc26d7db5dbd8051
  • libstd-rust1.86-dev_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:005220ff5fb712972386a5d856aa103936de942a
  • rust1.86-analyzer_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:8f90a58667b6c6cb596c3835d32cf33b2e18bbe0
  • rust1.86-clippy_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:6f97de2d386218a41a48d88fc7b2f0b93f28cb5c
  • rust1.86-llvm_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:f23035155e226726e5fb530c4a16986a0b7b94bd
  • rustc1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:55fae1bd4ac9cd0255727195c433ea02b70ef678
  • rustfmt1.86_1.86.0+dfsg1-1~bpo13+2+tuxcare.els8_arm64.deb
    sha:c9fed72ae34839aa109e682855f18c68b21c8963
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.