Skip to content

Commit 5632380

Browse files
chore(deps): update astral-tokio-tar from 0.6.0 to 0.6.1 (#940)
Addresses vulnerability: ``` error[vulnerability]: PAX Header Desynchronization in astral-tokio-tar ┌─ /src/myproject/Cargo.lock:12:1 │ 12 │ astral-tokio-tar 0.6.0 registry+https://github.com/rust-lang/crates.io-index │ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected │ ├ ID: RUSTSEC-2026-0112 ├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0112 ├ Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker could use this differential to smuggle unexpected files onto a victim's filesystem. ├ Announcement: GHSA-fp55-jw48-c537 ├ Solution: Upgrade to >=0.6.1 (try `cargo update -p astral-tokio-tar`) ├ astral-tokio-tar v0.6.0 └── testcontainers v0.27.3
1 parent 2c96733 commit 5632380

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

testcontainers/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ signal-hook = { version = "0.4", optional = true }
4545
thiserror = "2.0.3"
4646
tokio = { version = "1", features = ["macros", "fs", "rt-multi-thread", "process"] }
4747
tokio-stream = "0.1.15"
48-
astral-tokio-tar = "0.6.0"
48+
astral-tokio-tar = "0.6.1"
4949
tokio-util = { version = "0.7.10", features = ["io"] }
5050
ferroid = { version = "2.0.0", features = ["std", "ulid", "base32"] }
5151
url = { version = "2", features = ["serde"] }

0 commit comments

Comments
 (0)