RHSA-2026:70390

Vulnerability from csaf_opensuse - Published: 2026-09-22 00:00 - Updated: 2026-09-23 17:25
Summary
security update for tar
Severity
Moderate
Notes
Title of the patch: security update for tar
Description of the patch: This security update provides a functional equivalent of RHSA-2026:70390. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:70390.
Patchnames: RHSA-2026:70390
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2025-45582
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-18477
4.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Affected products
Recommended 1 product, the same list as for CVE-2025-45582
Threats
Impact moderate
CVE-2026-18508
4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
Recommended 1 product, the same list as for CVE-2025-45582
Threats
Impact moderate
CVE-2026-5704
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
Recommended 1 product, the same list as for CVE-2025-45582
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for tar",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2026:70390.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:70390.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2026:70390",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_70390.json"
      },
      {
        "category": "self",
        "summary": "URL for RHSA-2026:70390",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007934.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for RHSA-2026:70390",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-September/007934.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-45582 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-45582/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-18477 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-18477/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-18508 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-18508/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-5704 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-5704/"
      }
    ],
    "title": "security update for tar",
    "tracking": {
      "current_release_date": "2026-09-23T17:25:39Z",
      "generator": {
        "date": "2026-09-22T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2026:70390",
      "initial_release_date": "2026-09-22T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-09-22T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-23T17:25:39Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.30-13.el8_10.x86_64",
                "product": {
                  "name": "tar-2:1.30-13.el8_10.x86_64",
                  "product_id": "tar-2:1.30-13.el8_10.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:gnu:tar:1.30:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/tar@1.30-13.el8_10?arch=x86_64\u0026epoch=2\u0026upstream=tar-2:1.30-13.el8_10.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.30-13.el8_10.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
        },
        "product_reference": "tar-2:1.30-13.el8_10.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-45582",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-45582"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file\u0027s name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains \u0027..\u0027\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -\u003e ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-45582",
          "url": "https://www.suse.com/security/cve/CVE-2025-45582"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246399 for CVE-2025-45582",
          "url": "https://bugzilla.suse.com/1246399"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265450 for CVE-2025-45582",
          "url": "https://bugzilla.suse.com/1265450"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266731 for CVE-2025-45582",
          "url": "https://bugzilla.suse.com/1266731"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1267189 for CVE-2025-45582",
          "url": "https://bugzilla.suse.com/1267189"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-45582"
    },
    {
      "cve": "CVE-2026-18477",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-18477"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar\u0027s incremental dumpdir \u0027X\u0027 rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalation. Exploitation does not require the attacker to modify or craft the archive, and standard backup and restore workflows-including extracting into a newly created directory without using the -P option do not mitigate the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-18477",
          "url": "https://www.suse.com/security/cve/CVE-2026-18477"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274489 for CVE-2026-18477",
          "url": "https://bugzilla.suse.com/1274489"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-18477"
    },
    {
      "cve": "CVE-2026-18508",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-18508"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-18508",
          "url": "https://www.suse.com/security/cve/CVE-2026-18508"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1274490 for CVE-2026-18508",
          "url": "https://bugzilla.suse.com/1274490"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-18508"
    },
    {
      "cve": "CVE-2026-5704",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-5704"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-5704",
          "url": "https://www.suse.com/security/cve/CVE-2026-5704"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261900 for CVE-2026-5704",
          "url": "https://bugzilla.suse.com/1261900"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:tar-2:1.30-13.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-22T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-5704"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.