Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "ndaal archmeld 1.2.3 bumps the `tar` dependency 0.4.44 -> 0.4.46. Unlike the sibling currency advisories in this run, this bump REMEDIATES 2 published RUSTSEC advisories (CVE-2026-33056, CVE-2026-33055) that affected tar 0.4.44. tar TAR archive parsing and entry unpacking (also the inner layer of .tar.gz / .tar.xz / .tar.zst). Machine-readable dual CVSS 3.1 + 4.0 metrics are carried per vulnerability below.",
"title": "Summary"
},
{
"category": "details",
"text": "Change: Cargo.lock tar 0.4.44 -> 0.4.46, picked up by `cargo update` against the version requirement already in Cargo.toml (unchanged, semver-compatible). Verification: `cargo build --all-features` is clean, the full suite passes unchanged (137 tests: 67 unit + 70 integration, 0 failed), and `cargo audit --deny warnings --deny unsound --deny unmaintained --deny yanked` no longer reports any finding for tar.",
"title": "Remediation"
},
{
"category": "general",
"text": "Recommended action: rebuild archmeld from the updated Cargo.lock. Operators running a build that predates 2026-08-08 are running tar 0.4.44 and should rebuild. No configuration change and no source change in archmeld itself is required.",
"title": "Recommended Action"
},
{
"category": "general",
"text": "archmeld is a secure, memory-safe, type-safe single-binary command-line tool for multi-format archive extraction, inspection and decompression (ZIP, TAR, 7z, LHA/LZH, XAR/PKG, gzip, bzip2, xz/LZMA, zstd, LZ4, StuffIt, Compact Pro, DDS). It parses attacker-supplied archive bytes by design, so its decompression and unpacking dependencies are on the primary trust boundary.",
"title": "Product Description"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.",
"title": "Legal Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/402/ndaal-sa-2026-402.json"
},
{
"category": "external",
"summary": "archmeld source code",
"url": "https://github.com/ndaal/archmeld"
},
{
"category": "external",
"summary": "archmeld on crates.io",
"url": "https://crates.io/crates/archmeld"
},
{
"category": "external",
"summary": "tar 0.4.46 on crates.io",
"url": "https://crates.io/crates/tar/0.4.46"
},
{
"category": "external",
"summary": "RUSTSEC-2026-0067",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0067"
},
{
"category": "external",
"summary": "RUSTSEC-2026-0068",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0068"
}
],
"title": "ndaal Security Advisory: tar 0.4.44 -> 0.4.46 remediates CVE-2026-33056, CVE-2026-33055 in archmeld 1.2.3",
"tracking": {
"current_release_date": "2026-08-08T12:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-402",
"initial_release_date": "2026-08-08T12:00:00.000Z",
"revision_history": [
{
"date": "2026-08-08T12:00:00.000Z",
"number": "1.0.0",
"summary": "Initial advisory: tar 0.4.44 -> 0.4.46 remediates CVE-2026-33056, CVE-2026-33055."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "archmeld",
"branches": [
{
"category": "product_version",
"name": "2026-08-08 (pre-bump)",
"product": {
"name": "ndaal archmeld 1.2.3 (2026-08-08 (pre-bump))",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "2026-08-08 (post-bump)",
"product": {
"name": "ndaal archmeld 1.2.3 (2026-08-08 (post-bump))",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33056",
"ids": [
{
"system_name": "RUSTSEC Advisory Database",
"text": "RUSTSEC-2026-0067"
},
{
"system_name": "MITRE CVE",
"text": "CVE-2026-33056"
}
],
"notes": [
{
"category": "description",
"text": "Entry::unpack / Entry::unpack_in in tar < 0.4.45 follow symbolic links when applying directory permissions, letting a crafted archive chmod a directory outside the intended extraction root. archmeld reachability: DIRECT AND REACHABLE -- `archmeld extract` unpacks attacker-supplied TAR entries, and path-boundary integrity is a core archmeld security property. The v4.0 vector is the one published by RUSTSEC; the v3.1 vector is derived by ndaal (UI:A -> UI:R, scope unchanged).",
"title": "Description"
},
{
"category": "details",
"text": "Remediated in archmeld by advancing tar 0.4.44 -> 0.4.46 in Cargo.lock via `cargo update` (no Cargo.toml requirement change was needed). CVSS v3.1 base score 4.3 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. CVSS v4.0 base score 5.1 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N.",
"title": "Remediation Detail"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Rebuild archmeld 1.2.3 against the Cargo.lock dated 2026-08-08, which bundles tar 0.4.46.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "Entry::unpack / Entry::unpack_in in tar < 0.4.45 follow symbolic links when applying directory permissions, letting a crafted archive chmod a directory outside the intended extraction root. archmeld reachability: DIRECT AND REACHABLE -- `archmeld extract` unpacks attacker-supplied TAR entries, and path-boundary integrity is a core archmeld security property. The v4.0 vector is the one published by RUSTSEC; the v3.1 vector is derived by ndaal (UI:A -> UI:R, scope unchanged).",
"product_ids": [
"CSAFPID-0001"
]
}
],
"title": "tar-rs unpack_in can chmod arbitrary directories by following symlinks",
"references": [
{
"category": "external",
"summary": "RUSTSEC-2026-0067",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0067"
}
]
},
{
"cve": "CVE-2026-33055",
"ids": [
{
"system_name": "RUSTSEC Advisory Database",
"text": "RUSTSEC-2026-0068"
},
{
"system_name": "MITRE CVE",
"text": "CVE-2026-33055"
}
],
"notes": [
{
"category": "description",
"text": "tar < 0.4.45 ignores a PAX extended size header when the ustar header size field is nonzero, so the parser can disagree with other TAR implementations about where an entry ends -- an archive-desynchronisation primitive that lets content be hidden from, or differ between, scanners and the extractor. archmeld reachability: DIRECT AND REACHABLE -- archmeld both inspects (`info` / `list`) and extracts TAR streams, so a parser disagreement directly undermines what `archmeld list` reports versus what `archmeld extract` writes. The v4.0 vector is the one published by RUSTSEC; the v3.1 vector is derived by ndaal (UI:A -> UI:R, scope unchanged).",
"title": "Description"
},
{
"category": "details",
"text": "Remediated in archmeld by advancing tar 0.4.44 -> 0.4.46 in Cargo.lock via `cargo update` (no Cargo.toml requirement change was needed). CVSS v3.1 base score 5.4 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. CVSS v4.0 base score 5.1 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N.",
"title": "Remediation Detail"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Rebuild archmeld 1.2.3 against the Cargo.lock dated 2026-08-08, which bundles tar 0.4.46.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "ACTIVE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"threats": [
{
"category": "impact",
"details": "tar < 0.4.45 ignores a PAX extended size header when the ustar header size field is nonzero, so the parser can disagree with other TAR implementations about where an entry ends -- an archive-desynchronisation primitive that lets content be hidden from, or differ between, scanners and the extractor. archmeld reachability: DIRECT AND REACHABLE -- archmeld both inspects (`info` / `list`) and extracts TAR streams, so a parser disagreement directly undermines what `archmeld list` reports versus what `archmeld extract` writes. The v4.0 vector is the one published by RUSTSEC; the v3.1 vector is derived by ndaal (UI:A -> UI:R, scope unchanged).",
"product_ids": [
"CSAFPID-0001"
]
}
],
"title": "tar-rs incorrectly ignores PAX size headers if the header size is nonzero",
"references": [
{
"category": "external",
"summary": "RUSTSEC-2026-0068",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0068"
}
]
}
]
}