CVE-2021-38511
CVE-2021-38511
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.
CVSS 7.5 · High · EPSS 1.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
rust-tar Debian:12
- Affected ranges
- ECOSYSTEM: < 0.4.37-1
Update to 0.4.37-1
rust-tar Debian:13
- Affected ranges
- ECOSYSTEM: < 0.4.37-1
Update to 0.4.37-1
rust-tar Debian:14
- Affected ranges
- ECOSYSTEM: < 0.4.37-1
Update to 0.4.37-1
rust-tar Ubuntu:Pro:20.04:LTS
- Versions
- 0.4.26-1
- 0.4.26-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rust-tar Ubuntu:Pro:22.04:LTS
- Versions
- 0.4.26-1
- 0.4.37-1
- 0.4.37-3
- 0.4.37-3ubuntu0.1~esm1
- 0.4.37-3ubuntu0.1
- 0.4.37-3ubuntu0.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rust-tar Ubuntu:24.04:LTS
- Versions
- 0.4.38-2
- 0.4.40-1
- 0.4.40-1ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rust-tar Ubuntu:25.10
- Versions
- 0.4.43-4
- 0.4.43-4ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rust-tar Ubuntu:26.10
- Versions
- 0.4.45-1
- 0.4.45-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rust-tar Ubuntu:26.04:LTS
- Versions
- 0.4.43-4
- 0.4.44-1
- 0.4.45-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published