mab122
/
radicle-heartwood-lfs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update radicle-surf to 0.27.1 

This version resolves the vulnerability from the `tar-rs` transitive
dependency.

`cargo deny check` output:
```
error[vulnerability]: tar-rs incorrectly ignores PAX size headers if header size is nonzero
    ┌─ /home/fintohaps/Developer/heartwood/Cargo.lock:362:1
    │
362 │ tar 0.4.44 registry+https://github.com/rust-lang/crates.io-index
    │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
    │
    ├ ID: RUSTSEC-2026-0068
    ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0068
    ├ Versions 0.4.44 and below of tar-rs have conditional logic that skips the PAX
      size header in cases where the base header size is nonzero.
      
      As part of [CVE-2025-62518][astral-cve], the [astral-tokio-tar]
      project was changed to correctly honor PAX size headers in the case where it
      was different from the base header. This is almost the inverse of the
      astral-tokio-tar issue.
      
      Any discrepancy in how tar parsers honor file size can be used to create
      archives that appear differently when unpacked by different archivers. In this
      case, the tar-rs (Rust tar) crate is an outlier in checking for the header size
      — other tar parsers (including e.g. Go [`archive/tar`][go-tar]) unconditionally
      use the PAX size override. This can affect anything that uses the tar crate to
      parse archives and expects to have a consistent view with other parsers.
      
      This issue has been fixed in version 0.4.45.
      
      [astral-cve]: https://www.cve.org/CVERecord?id=CVE-2025-62518
      [astral-tokio-tar]: https://github.com/astral-sh/tokio-tar
      [go-tar]: https://pkg.go.dev/archive/tar
    ├ Solution: Upgrade to >=0.4.45 (try `cargo update -p tar`)
    ├ tar v0.4.44
      └── (build) radicle-surf v0.27.0
          └── radicle-cli v0.19.0
              └── radicle-remote-helper v0.15.0
```
This commit is contained in:
Fintan Halpenny 2026-04-02 14:32:46 +01:00
parent 546001253a
commit 5b6ae0ac4a
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Cargo.lock generated
View File

@ -3342,9 +3342,9 @@ checksum = "fb935931bdd2a2966f3b584f3031d9d54ec0713ddbc563a0193d54e62a88ec73"
[[package]] [[package]]
name = "radicle-surf" name = "radicle-surf"
version = "0.27.0" version = "0.27.1"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e2c6a29eac2e55a6d0632c8faeb3cbe91afb1e07be60d157a27fdadb8cc4c508" checksum = "a2dfaa46d3e05ca10fc5841bb9cfac9fe6d3685cf2a02b16972f4cafbb888bd1"
dependencies = [ dependencies = [
"anyhow", "anyhow",
"base64 0.21.7", "base64 0.21.7",
@ -4274,9 +4274,9 @@ dependencies = [
[[package]] [[package]]
name = "tar" name = "tar"
version = "0.4.44" version = "0.4.45"
source = "registry+https://github.com/rust-lang/crates.io-index" source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1d863878d212c87a19c1a610eb53bb01fe12951c0501cf5a0d65f724914a667a" checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
dependencies = [ dependencies = [
"filetime", "filetime",
"libc", "libc",

2
Cargo.toml
View File

@ -83,7 +83,7 @@ zeroize = "1.5.7"
# `radicle-surf` → `radicle-git-ext` → `git-ref-format` → `git-ref-format-core` # `radicle-surf` → `radicle-git-ext` → `git-ref-format` → `git-ref-format-core`
# Also note that `radicle-surf → git2` so try to also sync with `git2`. # Also note that `radicle-surf → git2` so try to also sync with `git2`.
git-ref-format-core = { version = "0.6.0", default-features = false } git-ref-format-core = { version = "0.6.0", default-features = false }
radicle-surf = "0.27.0" radicle-surf = "0.27.1"
[workspace.lints] [workspace.lints]
clippy.type_complexity = "allow" clippy.type_complexity = "allow"