{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"ndaal archmeld 1.2.3 bumps the `tar` dependency 0.4.44 -> 0.4.46. Unlike the sibling currency advisories in this run, this bump REMEDIATES 2 published RUSTSEC advisories (CVE-2026-33056, CVE-2026-33055) that affected tar 0.4.44. tar TAR archive parsing and entry unpacking (also the inner layer of .tar.gz / .tar.xz / .tar.zst). Machine-readable dual CVSS 3.1 + 4.0 metrics are carried per vulnerability below.","title":"Summary"},{"category":"details","text":"Change: Cargo.lock tar 0.4.44 -> 0.4.46, picked up by `cargo update` against the version requirement already in Cargo.toml (unchanged, semver-compatible). Verification: `cargo build --all-features` is clean, the full suite passes unchanged (137 tests: 67 unit + 70 integration, 0 failed), and `cargo audit --deny warnings --deny unsound --deny unmaintained --deny yanked` no longer reports any finding for tar.","title":"Remediation"},{"category":"general","text":"Recommended action: rebuild archmeld from the updated Cargo.lock. Operators running a build that predates 2026-08-08 are running tar 0.4.44 and should rebuild. No configuration change and no source change in archmeld itself is required.","title":"Recommended Action"},{"category":"general","text":"archmeld is a secure, memory-safe, type-safe single-binary command-line tool for multi-format archive extraction, inspection and decompression (ZIP, TAR, 7z, LHA/LZH, XAR/PKG, gzip, bzip2, xz/LZMA, zstd, LZ4, StuffIt, Compact Pro, DDS). It parses attacker-supplied archive bytes by design, so its decompression and unpacking dependencies are on the primary trust boundary.","title":"Product Description"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS.","title":"Legal Disclaimer"}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_csaf_information/-/raw/main/csaf/2026/402/ndaal-sa-2026-402.json"},{"category":"external","summary":"archmeld source code","url":"https://github.com/ndaal/archmeld"},{"category":"external","summary":"archmeld on crates.io","url":"https://crates.io/crates/archmeld"},{"category":"external","summary":"tar 0.4.46 on crates.io","url":"https://crates.io/crates/tar/0.4.46"},{"category":"external","summary":"RUSTSEC-2026-0067","url":"https://rustsec.org/advisories/RUSTSEC-2026-0067"},{"category":"external","summary":"RUSTSEC-2026-0068","url":"https://rustsec.org/advisories/RUSTSEC-2026-0068"}],"title":"ndaal Security Advisory: tar 0.4.44 -> 0.4.46 remediates CVE-2026-33056, CVE-2026-33055 in archmeld 1.2.3","tracking":{"current_release_date":"2026-08-08T12:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-402","initial_release_date":"2026-08-08T12:00:00.000Z","revision_history":[{"date":"2026-08-08T12:00:00.000Z","number":"1.0.0","summary":"Initial advisory: tar 0.4.44 -> 0.4.46 remediates CVE-2026-33056, CVE-2026-33055."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft für Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"archmeld","branches":[{"category":"product_version","name":"2026-08-08 (pre-bump)","product":{"name":"ndaal archmeld 1.2.3 (2026-08-08 (pre-bump))","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"2026-08-08 (post-bump)","product":{"name":"ndaal archmeld 1.2.3 (2026-08-08 (post-bump))","product_id":"CSAFPID-0002"}}]}]}]},"vulnerabilities":[{"cve":"CVE-2026-33056","ids":[{"system_name":"RUSTSEC Advisory Database","text":"RUSTSEC-2026-0067"},{"system_name":"MITRE CVE","text":"CVE-2026-33056"}],"notes":[{"category":"description","text":"Entry::unpack / Entry::unpack_in in tar < 0.4.45 follow symbolic links when applying directory permissions, letting a crafted archive chmod a directory outside the intended extraction root. archmeld reachability: DIRECT AND REACHABLE -- `archmeld extract` unpacks attacker-supplied TAR entries, and path-boundary integrity is a core archmeld security property. The v4.0 vector is the one published by RUSTSEC; the v3.1 vector is derived by ndaal (UI:A -> UI:R, scope unchanged).","title":"Description"},{"category":"details","text":"Remediated in archmeld by advancing tar 0.4.44 -> 0.4.46 in Cargo.lock via `cargo update` (no Cargo.toml requirement change was needed). CVSS v3.1 base score 4.3 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. CVSS v4.0 base score 5.1 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N.","title":"Remediation Detail"}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Rebuild archmeld 1.2.3 against the Cargo.lock dated 2026-08-08, which bundles tar 0.4.46.","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"Entry::unpack / Entry::unpack_in in tar < 0.4.45 follow symbolic links when applying directory permissions, letting a crafted archive chmod a directory outside the intended extraction root. archmeld reachability: DIRECT AND REACHABLE -- `archmeld extract` unpacks attacker-supplied TAR entries, and path-boundary integrity is a core archmeld security property. The v4.0 vector is the one published by RUSTSEC; the v3.1 vector is derived by ndaal (UI:A -> UI:R, scope unchanged).","product_ids":["CSAFPID-0001"]}],"title":"tar-rs unpack_in can chmod arbitrary directories by following symlinks","references":[{"category":"external","summary":"RUSTSEC-2026-0067","url":"https://rustsec.org/advisories/RUSTSEC-2026-0067"}]},{"cve":"CVE-2026-33055","ids":[{"system_name":"RUSTSEC Advisory Database","text":"RUSTSEC-2026-0068"},{"system_name":"MITRE CVE","text":"CVE-2026-33055"}],"notes":[{"category":"description","text":"tar < 0.4.45 ignores a PAX extended size header when the ustar header size field is nonzero, so the parser can disagree with other TAR implementations about where an entry ends -- an archive-desynchronisation primitive that lets content be hidden from, or differ between, scanners and the extractor. archmeld reachability: DIRECT AND REACHABLE -- archmeld both inspects (`info` / `list`) and extracts TAR streams, so a parser disagreement directly undermines what `archmeld list` reports versus what `archmeld extract` writes. The v4.0 vector is the one published by RUSTSEC; the v3.1 vector is derived by ndaal (UI:A -> UI:R, scope unchanged).","title":"Description"},{"category":"details","text":"Remediated in archmeld by advancing tar 0.4.44 -> 0.4.46 in Cargo.lock via `cargo update` (no Cargo.toml requirement change was needed). CVSS v3.1 base score 5.4 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. CVSS v4.0 base score 5.1 (MEDIUM), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N.","title":"Remediation Detail"}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Rebuild archmeld 1.2.3 against the Cargo.lock dated 2026-08-08, which bundles tar 0.4.46.","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"threats":[{"category":"impact","details":"tar < 0.4.45 ignores a PAX extended size header when the ustar header size field is nonzero, so the parser can disagree with other TAR implementations about where an entry ends -- an archive-desynchronisation primitive that lets content be hidden from, or differ between, scanners and the extractor. archmeld reachability: DIRECT AND REACHABLE -- archmeld both inspects (`info` / `list`) and extracts TAR streams, so a parser disagreement directly undermines what `archmeld list` reports versus what `archmeld extract` writes. The v4.0 vector is the one published by RUSTSEC; the v3.1 vector is derived by ndaal (UI:A -> UI:R, scope unchanged).","product_ids":["CSAFPID-0001"]}],"title":"tar-rs incorrectly ignores PAX size headers if the header size is nonzero","references":[{"category":"external","summary":"RUSTSEC-2026-0068","url":"https://rustsec.org/advisories/RUSTSEC-2026-0068"}]}]}