CVE-2026-33056: Packages that depend on rust-tar might still contain vulnerable code
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| elan (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Jammy |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Noble |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| python-maturin (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Noble |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Won't Fix
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| ripgrep-all (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rust-cargo-c (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rust-cargo-outdated (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Noble |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rust-cargo-vendor-filterer (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Won't Fix
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rust-debcargo (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Jammy |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Noble |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rust-magic-wormhole-cli (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rust-procs (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rust-rebuildctl (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rust-repro-env (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Noble |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| rustup (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Noble |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| sccache (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Noble |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| warp (Ubuntu) |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Questing |
Fix Released
|
Undecided
|
Ruan Comelli | ||
| Resolute |
Fix Released
|
Undecided
|
Ruan Comelli | ||
Bug Description
Packages that build-depend on rust-tar directly or indirectly may contain vulnerable code.
Recently, rust-tar has been patched to fix a CVE (https:/
However, no-change rebuilds are still necessary for all packages that either (1) build-depend on librust-tar-X.Y-dev or (2) on other librust-$LIB-dev packages that, in turn, depend on librust-
For example: rust-cargo-c on Noble does not vendor the tar crate. However, it build-depends on librust-cargo-dev which, in turn, depends on librust-
CVE record: https:/
LP bug tracking the packages vendoring the tar crate: https:/
| no longer affects: | elan (Ubuntu Focal) |
| no longer affects: | python-maturin (Ubuntu Focal) |
| no longer affects: | python-maturin (Ubuntu Jammy) |
| no longer affects: | rust-libsodium-sys (Ubuntu) |
| no longer affects: | rust-libsodium-sys (Ubuntu Noble) |
| no longer affects: | rust-libsodium-sys (Ubuntu Questing) |
| no longer affects: | rust-libsodium-sys (Ubuntu Resolute) |
| no longer affects: | rust-cargo (Ubuntu Focal) |
| no longer affects: | rust-debcargo (Ubuntu Focal) |
| no longer affects: | rust-fomat-macros (Ubuntu Focal) |
| no longer affects: | rust-cargo-outdated (Ubuntu Focal) |
| no longer affects: | rust-cargo-outdated (Ubuntu Jammy) |
| no longer affects: | rust-python-pkginfo (Ubuntu Focal) |
| no longer affects: | rust-python-pkginfo (Ubuntu Jammy) |
| no longer affects: | rust-repro-env (Ubuntu Focal) |
| no longer affects: | rust-repro-env (Ubuntu Jammy) |
| no longer affects: | rust-ripasso (Ubuntu Focal) |
| no longer affects: | rust-ripasso (Ubuntu Jammy) |
| no longer affects: | rust-rust-unixfs (Ubuntu Focal) |
| no longer affects: | rust-rust-unixfs (Ubuntu Jammy) |
| no longer affects: | rust-syn-1 (Ubuntu Focal) |
| no longer affects: | rust-syn-1 (Ubuntu Jammy) |
| no longer affects: | rustup (Ubuntu Focal) |
| no longer affects: | rustup (Ubuntu Jammy) |
| no longer affects: | sccache (Ubuntu Focal) |
| no longer affects: | sccache (Ubuntu Jammy) |
| no longer affects: | rust-cargo-test-support (Ubuntu Focal) |
| no longer affects: | rust-cargo-test-support (Ubuntu Jammy) |
| no longer affects: | rust-cargo-test-support (Ubuntu Noble) |
| no longer affects: | rust-cargo-vendor-filterer (Ubuntu Focal) |
| no longer affects: | rust-cargo-vendor-filterer (Ubuntu Jammy) |
| no longer affects: | rust-cargo-vendor-filterer (Ubuntu Noble) |
| no longer affects: | rust-dockworker (Ubuntu Focal) |
| no longer affects: | rust-dockworker (Ubuntu Jammy) |
| no longer affects: | rust-dockworker (Ubuntu Noble) |
| no longer affects: | rust-gix (Ubuntu Focal) |
| no longer affects: | rust-gix (Ubuntu Jammy) |
| no longer affects: | rust-gix (Ubuntu Noble) |
| no longer affects: | rust-gix-archive (Ubuntu Focal) |
| no longer affects: | rust-gix-archive (Ubuntu Jammy) |
| no longer affects: | rust-gix-archive (Ubuntu Noble) |
| no longer affects: | rust-magic-wormhole (Ubuntu Focal) |
| no longer affects: | rust-magic-wormhole (Ubuntu Jammy) |
| no longer affects: | rust-magic-wormhole (Ubuntu Noble) |
| no longer affects: | rust-magic-wormhole-cli (Ubuntu Focal) |
| no longer affects: | rust-magic-wormhole-cli (Ubuntu Jammy) |
| no longer affects: | rust-magic-wormhole-cli (Ubuntu Noble) |
| no longer affects: | rust-proc-macro2 (Ubuntu Focal) |
| no longer affects: | rust-proc-macro2 (Ubuntu Jammy) |
| no longer affects: | rust-proc-macro2 (Ubuntu Noble) |
| no longer affects: | rust-procs (Ubuntu Focal) |
| no longer affects: | rust-procs (Ubuntu Jammy) |
| no longer affects: | rust-procs (Ubuntu Noble) |
| no longer affects: | rust-rebuildctl (Ubuntu Focal) |
| no longer affects: | rust-rebuildctl (Ubuntu Jammy) |
| no longer affects: | rust-rebuildctl (Ubuntu Noble) |
| no longer affects: | rust-upstream-ontologist (Ubuntu Focal) |
| no longer affects: | rust-upstream-ontologist (Ubuntu Jammy) |
| no longer affects: | rust-upstream-ontologist (Ubuntu Noble) |
| no longer affects: | warp (Ubuntu Focal) |
| no longer affects: | warp (Ubuntu Jammy) |
| no longer affects: | warp (Ubuntu Noble) |
| no longer affects: | ripgrep-all (Ubuntu Focal) |
| no longer affects: | ripgrep-all (Ubuntu Jammy) |
| no longer affects: | ripgrep-all (Ubuntu Noble) |
| no longer affects: | ripgrep-all (Ubuntu Questing) |
| tags: | added: patch resolute |
| no longer affects: | rust-libsodium-sys (Ubuntu) |
| no longer affects: | rust-syn (Ubuntu Focal) |
| no longer affects: | rust-fomat-macros (Ubuntu Jammy) |
| no longer affects: | rust-syn (Ubuntu Jammy) |
| no longer affects: | rust-syn (Ubuntu) |
| no longer affects: | rust-cargo (Ubuntu) |
| Changed in rust-cargo-c (Ubuntu): | |
| milestone: | none → noble-updates |
| no longer affects: | rust-cargo-test-support (Ubuntu) |
| no longer affects: | rust-dockworker (Ubuntu) |
| no longer affects: | rust-fomat-macros (Ubuntu) |
| no longer affects: | rust-cargo-test-support (Ubuntu Questing) |
| no longer affects: | rust-cargo (Ubuntu Jammy) |
| no longer affects: | rust-cargo (Ubuntu Noble) |
| no longer affects: | rust-cargo (Ubuntu Questing) |
| no longer affects: | rust-cargo (Ubuntu Resolute) |
| no longer affects: | rust-cargo-test-support (Ubuntu Resolute) |
| no longer affects: | rust-dockworker (Ubuntu Questing) |
| no longer affects: | rust-dockworker (Ubuntu Resolute) |
| no longer affects: | rust-gix (Ubuntu) |
| no longer affects: | rust-gix (Ubuntu Questing) |
| no longer affects: | rust-fomat-macros (Ubuntu Noble) |
| no longer affects: | rust-fomat-macros (Ubuntu Questing) |
| no longer affects: | rust-fomat-macros (Ubuntu Resolute) |
| no longer affects: | rust-gix (Ubuntu Resolute) |
| no longer affects: | rust-gix-archive (Ubuntu) |
| no longer affects: | rust-magic-wormhole (Ubuntu) |
| no longer affects: | rust-magic-wormhole (Ubuntu Resolute) |
| no longer affects: | rust-magic-wormhole (Ubuntu Questing) |
| no longer affects: | rust-gix-archive (Ubuntu Questing) |
| no longer affects: | rust-proc-macro2 (Ubuntu) |
| no longer affects: | rust-gix-archive (Ubuntu Resolute) |
| no longer affects: | rust-proc-macro2 (Ubuntu Questing) |
| no longer affects: | rust-python-pkginfo (Ubuntu) |
| no longer affects: | rust-ripasso (Ubuntu) |
| no longer affects: | rust-rust-unixfs (Ubuntu) |
| no longer affects: | rust-syn-1 (Ubuntu) |
| no longer affects: | rust-upstream-ontologist (Ubuntu) |
| no longer affects: | rust-proc-macro2 (Ubuntu Resolute) |
| no longer affects: | rust-python-pkginfo (Ubuntu Noble) |
| no longer affects: | rust-python-pkginfo (Ubuntu Questing) |
| no longer affects: | rust-python-pkginfo (Ubuntu Resolute) |
| no longer affects: | rust-ripasso (Ubuntu Noble) |
| no longer affects: | rust-ripasso (Ubuntu Questing) |
| no longer affects: | rust-ripasso (Ubuntu Resolute) |
| no longer affects: | rust-rust-unixfs (Ubuntu Noble) |
| no longer affects: | rust-rust-unixfs (Ubuntu Questing) |
| no longer affects: | rust-rust-unixfs (Ubuntu Resolute) |
| no longer affects: | rust-syn (Ubuntu Noble) |
| no longer affects: | rust-syn (Ubuntu Questing) |
| no longer affects: | rust-syn (Ubuntu Resolute) |
| no longer affects: | rust-upstream-ontologist (Ubuntu Resolute) |
| no longer affects: | rust-upstream-ontologist (Ubuntu Questing) |
| no longer affects: | rust-syn-1 (Ubuntu Resolute) |
| no longer affects: | rust-syn-1 (Ubuntu Noble) |
| no longer affects: | rust-syn-1 (Ubuntu Questing) |
| tags: | added: foundations-todo |
| Changed in warp (Ubuntu Questing): | |
| milestone: | none → questing-updates |
| Changed in warp (Ubuntu Resolute): | |
| milestone: | none → resolute-updates |
| Changed in sccache (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| milestone: | none → resolute-updates |
| Changed in warp (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| status: | New → In Progress |
| Changed in warp (Ubuntu Questing): | |
| milestone: | questing-updates → none |
| Changed in warp (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in warp (Ubuntu): | |
| status: | In Progress → Fix Released |
| Changed in elan (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in python-maturin (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in ripgrep-all (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-cargo-c (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-cargo-outdated (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-cargo-vendor-filterer (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-debcargo (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-magic-wormhole-cli (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-procs (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-rebuildctl (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-repro-env (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rustup (Ubuntu): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in elan (Ubuntu Jammy): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-debcargo (Ubuntu Jammy): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in elan (Ubuntu Noble): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in python-maturin (Ubuntu Noble): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-cargo-outdated (Ubuntu Noble): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-debcargo (Ubuntu Noble): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-repro-env (Ubuntu Noble): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rustup (Ubuntu Noble): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in sccache (Ubuntu Noble): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in elan (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in python-maturin (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-cargo-outdated (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-cargo-vendor-filterer (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-debcargo (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-magic-wormhole-cli (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-procs (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-rebuildctl (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-repro-env (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rustup (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in sccache (Ubuntu Questing): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in elan (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in python-maturin (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in ripgrep-all (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-cargo-outdated (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-cargo-vendor-filterer (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-debcargo (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-magic-wormhole-cli (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-procs (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-rebuildctl (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rust-repro-env (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in rustup (Ubuntu Resolute): | |
| assignee: | nobody → Ruan Comelli (ruancomelli) |
| Changed in elan (Ubuntu): | |
| status: | New → Fix Released |
| Changed in ripgrep-all (Ubuntu): | |
| status: | New → Fix Released |

A new rustup version was synced from Debian, and the build logs confirm that the patched librust-tar-0.4-dev version was pulled.