crates.io/tar CVE-2018-20990: high 7.5, EPSS 1.68%

Links in archives can overwrite any existing file

Action: Upgrade tar to 0.4.16 or later.

cargo update -p tar --precise 0.4.16

Affected

Fixed versions

Sources

• osv: RUSTSEC-2018-0002
• https://crates.io/crates/tar
• https://rustsec.org/advisories/RUSTSEC-2018-0002.html
• https://github.com/alexcrichton/tar-rs/pull/156

CVE-2018-20990 · published 2018-06-29T12:00:00Z · modified 2023-11-08T04:00:13.305474Z · JSON