Commit 5632380
authored
chore(deps): update astral-tokio-tar from 0.6.0 to 0.6.1 (#940)
Addresses vulnerability:
```
error[vulnerability]: PAX Header Desynchronization in astral-tokio-tar
┌─ /src/myproject/Cargo.lock:12:1
│
12 │ astral-tokio-tar 0.6.0 registry+https://github.com/rust-lang/crates.io-index
│ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ security vulnerability detected
│
├ ID: RUSTSEC-2026-0112
├ Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0112
├ Versions of astral-tokio-tar prior to 0.6.1 contain a PAX header interpretation
bug that allows manipulated entries to be made selectively visible or invisible
during extraction with astral-tokio-tar versus other tar implementations.
An attacker could use this differential to smuggle unexpected files onto a
victim's filesystem.
├ Announcement: GHSA-fp55-jw48-c537
├ Solution: Upgrade to >=0.6.1 (try `cargo update -p astral-tokio-tar`)
├ astral-tokio-tar v0.6.0
└── testcontainers v0.27.31 parent 2c96733 commit 5632380
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
45 | 45 | | |
46 | 46 | | |
47 | 47 | | |
48 | | - | |
| 48 | + | |
49 | 49 | | |
50 | 50 | | |
51 | 51 | | |
| |||
0 commit comments