{"id":"CLSA-2026-1788535576","summary":"rust: Fix of CVE-2026-33056","details":"- CVE-2026-33056: in the vendored tar crate, use symlink_metadata instead of\n  metadata when deciding whether an existing path is a directory, so a\n  symlink cannot redirect the subsequent chmod outside the extraction root\n  (applied to all three vendored copies: tar 0.4.38, 0.4.42 and 0.4.43)","modified":"2026-10-26T09:31:32.613157059Z","published":"2026-09-04T15:26:27Z","upstream":["CVE-2026-33056"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788535576.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33056"}],"affected":[{"package":{"name":"cargo","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/cargo?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"clippy","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/clippy?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-analyzer","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-analyzer?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-debugger-common","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-debugger-common?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-doc","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-doc?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-gdb","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-gdb?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-lldb","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-lldb?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-src","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-src?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-std-static","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-std-static?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-std-static-wasm32-unknown-unknown","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-std-static-wasm32-unknown-unknown?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-std-static-wasm32-wasip1","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-std-static-wasm32-wasip1?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rust-toolset","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rust-toolset?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}},{"package":{"name":"rustfmt","ecosystem":"TuxCare:AlmaLinux:9.6","purl":"pkg:rpm/tuxcare/rustfmt?distro=almalinux-9.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.84.1-1.el9_6.tuxcare.els1"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1788535576.json"}}],"schema_version":"1.9.0"}