{"id":146043,"date":"2025-10-21T23:12:42","date_gmt":"2025-10-21T21:12:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva"},"modified":"2025-10-21T23:12:42","modified_gmt":"2025-10-21T21:12:43","slug":"uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","title":{"rendered":"Zranitelnost v Rust knihovn\u00e1ch pro form\u00e1t TAR, kter\u00e1 vede k rozbalen\u00ed soubor\u016f z vno\u0159en\u00e9ho archivu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V knihovn\u011b async-tar napsan\u00e9 v jazyce Rust, kter\u00e1 poskytuje funkce pro \u010dten\u00ed a z\u00e1pis tar archiv\u016f, byla objevena zranitelnost (CVE-2025-62518, k\u00f3dov\u00e9 jm\u00e9no TARmageddon), kter\u00e1 umo\u017e\u0148uje p\u0159i rozbalov\u00e1n\u00ed speci\u00e1ln\u011b vytvo\u0159en\u00e9ho tar archivu nejen extrahovat soubory um\u00edst\u011bn\u00e9 v n\u011bm, ale tak\u00e9 soubory obsa\u017een\u00e9 ve vno\u0159en\u00e9m tar archivu. Zranitelnost m\u016f\u017ee b\u00fdt vyu\u017eita k obch\u00e1zen\u00ed syst\u00e9m\u016f verifikace archiv\u016f a rozbalen\u00ed soubor\u016f, pro kter\u00e9 nebyla provedena kontrola. <\/p>\n

Zranitelnost se projevuje tak\u00e9 ve fork\u00e1ch knihovny async-tar, jako jsou tokio-tar, krata-tokio-tar a astral-tokio-tar, stejn\u011b jako v n\u00e1stroj\u00edch postaven\u00fdch na jejich z\u00e1klad\u011b, nap\u0159\u00edklad v bal\u00ed\u010dkov\u00e9m mana\u017eeru uv, vyv\u00edjen\u00e9m jako vysoce v\u00fdkonn\u00e1 n\u00e1hrada za \u201epip\u201c pro projekty v jazyce Python. Mezi popul\u00e1rn\u00ed projekty, kter\u00e9 vyu\u017e\u00edvaj\u00ed zraniteln\u00e9 knihovny, pat\u0159\u00ed tak\u00e9 n\u00e1stroj testcontainers pro spu\u0161t\u011bn\u00ed docker kontejner\u016f a WebAssembly runtime wasmCloud. V repozit\u00e1\u0159i crates.is za posledn\u00edch 90 dn\u00ed m\u011bla knihovna async-tar 1,3 milionu sta\u017een\u00ed, tokio-tar \u2014 2,2 milionu, testcontainers \u2014 2,9 milionu. <\/p>\n

Zranitelnost je zp\u016fsobena nespr\u00e1vn\u00fdm v\u00fdb\u011brem pozice p\u0159i anal\u00fdze r\u016fzn\u00fdch hodnot velikosti v hlavi\u010dk\u00e1ch ustar a PAX. V tar archivech ve form\u00e1tu PAX jsou pro ka\u017ed\u00fd soubor uvnit\u0159 archivu uvedeny dv\u011b hlavi\u010dky \u2014 klasick\u00e1 ustar a roz\u0161\u00ed\u0159en\u00e1 PAX. Probl\u00e9m je zp\u016fsoben t\u00edm, \u017ee zraniteln\u00e9 knihovny p\u0159i rozbalov\u00e1n\u00ed soubor\u016f m\u00edsto v\u00fdpo\u010dtu posunut\u00ed na z\u00e1klad\u011b velikosti z roz\u0161\u00ed\u0159en\u00e9 hlavi\u010dky PAX braly velikost z zastaral\u00e9 hlavi\u010dky ustar. P\u0159i nulov\u00e9 hodnot\u011b velikosti v hlavi\u010dce ustar bylo n\u00e1sleduj\u00edc\u00ed obsah souboru zpracov\u00e1v\u00e1no jako platn\u00fd blok TAR hlavi\u010dek pro dal\u0161\u00ed soubor.

\"Zranitelnost<\/center>
\"Zranitelnost<\/center> <\/p>\n

Pro proveden\u00ed \u00fatoku sta\u010d\u00ed vytvo\u0159it TAR archiv, ve kter\u00e9m je v hlavi\u010dce ustar uvedena nulov\u00e1 velikost, zat\u00edmco v hlavi\u010dce pro form\u00e1t PAX aktu\u00e1ln\u00ed velikost, co\u017e zp\u016fsob\u00ed, \u017ee obsah souboru s jin\u00fdm tar archivem bude zpracov\u00e1n jako sou\u010d\u00e1st hlavn\u00edho archivu. P\u0159\u00edklad k\u00f3du pro vytvo\u0159en\u00ed podobn\u00fdch archiv\u016f je um\u00edst\u011bn na GitHubu. Zranitelnost byla odstran\u011bna ve verz\u00edch tokio-tar 0.5.6 a uv 0.9.5. Pro ostatn\u00ed knihovny zat\u00edm opravy zve\u0159ejn\u011bny nebyly, ale pro astral-tokio-tar, async-tar a krata-tokio-tar byly p\u0159ipraveny samostatn\u00e9 patche. <\/p>\n

Zranitelnosti v knihovn\u00e1ch byly hodnoceny na \u00farove\u0148 nebezpe\u010dnosti 8,1 z 10, proto\u017ee probl\u00e9m m\u016f\u017ee b\u00fdt pou\u017eit k p\u0159eps\u00e1n\u00ed rozbalovan\u00fdch soubor\u016f (v zraniteln\u00fdch implementac\u00edch budou rozbaleny jin\u00e9 soubory, ne\u017e kter\u00e9 byly viditeln\u00e9 v archivu). Zranitelnost v bal\u00ed\u010dkov\u00e9m spr\u00e1vci uv je p\u0159itom ozna\u010dena jako nez\u00e1vadn\u00e1, proto\u017ee pokud \u00fato\u010dn\u00edk m\u016f\u017ee ovlivnit obsah p\u016fvodn\u00edho archivu, nem\u00e1 smysl komplikovat \u00fatok a zneu\u017e\u00edvat zranitelnost prost\u0159ednictv\u00edm vno\u0159en\u00e9ho archivu, kdy\u017e lze dos\u00e1hnout proveden\u00ed k\u00f3du pomoc\u00ed build skript\u016f v hlavn\u00edm archivu. <\/p>\n

V\u00fdzkumn\u00edci objevuj\u00edc\u00ed zranitelnost navrhli n\u011bkolik hypotetick\u00fdch sc\u00e9n\u00e1\u0159\u016f \u00fatok\u016f, kter\u00e9 by umo\u017enily obch\u00e1zet bezpe\u010dnostn\u00ed kontroly a dos\u00e1hnout proveden\u00ed k\u00f3du prost\u0159ednictv\u00edm v\u00fdm\u011bny konfigura\u010dn\u00edch soubor\u016f nebo zasahov\u00e1n\u00edm do procesu sestavov\u00e1n\u00ed. P\u0159edpokl\u00e1d\u00e1 se, \u017ee zaslan\u00fd archiv projde automatizovanou kontrolou pomoc\u00ed bezpe\u010dnostn\u00edho skeneru a ru\u010dn\u00edm auditem, b\u011bhem kter\u00e9ho kontrolor nev\u0161imne zvl\u00e1\u0161tn\u00edho vno\u0159en\u00e9ho archivu s jin\u00fdmi soubory, po \u010dem\u017e bude p\u0159i rozbalen\u00ed pomoc\u00ed Rust knihoven vyta\u017eeno jin\u00e9 obsah, ne\u017e se o\u010dek\u00e1valo. <\/p>\n

Nap\u0159\u00edklad \u00fato\u010dn\u00edk m\u016f\u017ee nahr\u00e1t pozm\u011bn\u011bn\u00fd archiv do repozit\u00e1\u0159e PyPI, kter\u00fd projde kontrolou na z\u00e1klad\u011b anal\u00fdzy obsahu hlavn\u00edho archivu obsahuj\u00edc\u00edho legitimn\u00ed soubor pyproject.toml. P\u0159i zpracov\u00e1n\u00ed tohoto bal\u00ed\u010dku pomoc\u00ed n\u00e1stroje uv bude legitimn\u00ed pyproject.toml nahrazen \u0161kodlivou variantou z vno\u0159en\u00e9ho archivu, obsahuj\u00edc\u00ed p\u0159\u00edkazy, kter\u00e9 budou provedeny p\u0159i sestavov\u00e1n\u00ed na po\u010d\u00edta\u010di v\u00fdvoj\u00e1\u0159e nebo v syst\u00e9mu kontinu\u00e1ln\u00ed integrace. Podobn\u011b lze organizovat p\u0159episov\u00e1n\u00ed soubor\u016f kontejneru p\u0159i extrakci obrazu kontejneru pomoc\u00ed n\u00e1stroje testcontainers.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 async-tar, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-62518, \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TARmageddon), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u0444\u0430\u0439\u043b\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435\u0441\u044f \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c tar-\u0430\u0440\u0445\u0438\u0432\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0441\u0438\u0441\u0442\u0435\u043c \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":146044,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-146043","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v Rust knihovn\u00e1ch pro form\u00e1t TAR, vedouc\u00ed k rozbalov\u00e1n\u00ed soubor\u016f z vno\u0159en\u00e9ho archivu | ProHoster","description":"V knihovn\u011b async-tar napsan\u00e9 v jazyce Rust, kter\u00e1 poskytuje funkce pro \u010dten\u00ed a zapisov\u00e1n\u00ed tar archiv\u016f, byla nalezena zranitelnost (CVE-2025-62518, k\u00f3dov\u00e9 jm\u00e9no TARmageddon), kter\u00e1 umo\u017e\u0148uje p\u0159i rozbalov\u00e1n\u00ed speci\u00e1ln\u011b konstruovan\u00fdch arch\u00edv\u016f.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Rust-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0430\u0442\u0430 TAR, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0440\u0445\u0438\u0432\u0430 | ProHoster","og:description":"\u0412 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 async-tar, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-62518, \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TARmageddon), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-21T21:12:43+00:00","article:modified_time":"2025-10-21T21:12:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"146043","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 15:29:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:29:20","updated":"2026-01-23 15:29:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/146043","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=146043"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/146043\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/146044"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=146043"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=146043"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=146043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}