{"id":146043,"date":"2025-10-21T23:12:42","date_gmt":"2025-10-21T21:12:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva"},"modified":"2025-10-21T23:12:42","modified_gmt":"2025-10-21T21:12:43","slug":"uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","title":{"rendered":"O vulnerabilitate \u00een bibliotecile Rust pentru formatul TAR, care duce la extragerea fi\u0219ierelor dintr-un arhiv\u0103 \u00eennegrit\u0103.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen biblioteca scris\u0103 \u00een Rust, async-tar, care ofer\u0103 func\u021bii pentru citirea \u0219i scrierea arhivelor tar, a fost descoperit\u0103 o vulnerabilitate (CVE-2025-62518, nume de cod TARmageddon), care permite, la extragerea unei arhive tar special concepute, nu doar extragerea fi\u0219ierelor con\u021binute \u00een aceasta, ci \u0219i a fi\u0219ierelor dintr-o arhiv\u0103 tar \u00eenchis\u0103. Vulnerabilitatea poate fi folosit\u0103 pentru a ocoli sistemele de verificare a arhivelor \u0219i pentru a extrage fi\u0219iere pentru care nu s-a efectuat verificarea. <\/p>\n

Vulnerabilitatea apare, de asemenea, \u00een fork-urile bibliotecii async-tar, cum ar fi tokio-tar, krata-tokio-tar \u0219i astral-tokio-tar, precum \u0219i \u00een utilitarele bazate pe acestea, cum ar fi managerul de pachete uv, dezvoltat ca o alternativ\u0103 performant\u0103 la \u201epip\u201d pentru proiectele \u00een limbajul Python. Printre proiectele populare care utilizeaz\u0103 biblioteci vulnerabile se num\u0103r\u0103 \u0219i instrumentul testcontainers pentru rularea containerelor docker \u0219i runtime-ul WebAssembly wasmCloud. \u00cen repository-ul crates.is, \u00een ultimele 90 de zile, biblioteca async-tar a avut 1,3 milioane de desc\u0103rc\u0103ri, tokio-tar \u2014 2,2 milioane, testcontainers \u2014 2,9 milioane. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de alegerea incorect\u0103 a pozi\u021biei \u00een timpul analizei diferitelor valori ale dimensiunii din anteturile ustar \u0219i PAX. \u00cen arhivele tar \u00een format PAX, pentru fiecare fi\u0219ier din arhiv\u0103 se specific\u0103 dou\u0103 antete \u2014 clasicul ustar \u0219i extinsul PAX. Problema este c\u0103 bibliotecile vulnerabile, la dezarhivarea fi\u0219ierelor, \u00een loc s\u0103 calculeze deplasarea pe baza dimensiunii din antetul extins PAX, luau dimensiunea din antetul \u00eenvechit ustar. Cu o valoare zero a dimensiunii \u00een antetul ustar, con\u021binutul fi\u0219ierului care urmeaz\u0103 era tratat ca un bloc TAR valid pentru urm\u0103torul fi\u0219ier.

\"O<\/center>
\"O<\/center> <\/p>\n

Pentru a desf\u0103\u0219ura un atac, este suficient s\u0103 crea\u021bi o arhiv\u0103 TAR \u00een care \u00een antetul ustar este specificat\u0103 o dimensiune zero, iar \u00een antetul pentru formatul PAX dimensiunea actual\u0103, ceea ce face ca con\u021binutul unui fi\u0219ier cu o alt\u0103 arhiv\u0103 tar s\u0103 fie procesat ca parte a arhivei principale. Un exemplu de cod pentru a crea astfel de arhive este disponibil pe GitHub. Vulnerabilitatea a fost corectat\u0103 \u00een versiunile tokio-tar 0.5.6 \u0219i uv 0.9.5. Pentru celelalte biblioteci, corec\u021biile nu au fost publicate \u00eenc\u0103, dar pentru astral-tokio-tar, async-tar \u0219i krata-tokio-tar au fost preg\u0103tite patch-uri separate. <\/p>\n

Vulnerabilit\u0103\u021bile din biblioteci au fost evaluate cu un nivel de pericol de 8.1 din 10, deoarece problema poate fi utilizat\u0103 pentru a suprascrie fi\u0219ierele extrase (\u00een implement\u0103rile vulnerabile, vor fi extrase fi\u0219iere diferite fa\u021b\u0103 de cele vizibile \u00een arhiv\u0103). Totu\u0219i, vulnerabilitatea \u00een managerul de pachete uv este considerat\u0103 nepericuloas\u0103, deoarece, dac\u0103 un atacator poate influen\u021ba con\u021binutul arhivei originale, nu are sens s\u0103 complice atacul \u0219i s\u0103 exploateze vulnerabilitatea printr-o arhiv\u0103 \u00eencorporat\u0103, c\u00e2nd poate ob\u021bine execu\u021bia de cod prin scripturile de construire din arhiva principal\u0103. <\/p>\n

Cercet\u0103torii care au descoperit vulnerabilitatea au propus c\u00e2teva scenarii ipotetice de atac, care permit ocolirea verific\u0103rilor de securitate \u0219i ob\u021binerea execu\u021biei de cod prin \u00eenlocuirea fi\u0219ierelor de configurare sau interven\u021bia \u00een procesul de construire. Se sub\u00eentelege c\u0103 arhiva trimis\u0103 va putea trece o verificare automatizat\u0103 cu un scaner de securitate \u0219i un audit manual, \u00een timpul c\u0103ruia auditorul nu va observa o arhiv\u0103 \u00eencorporat\u0103 ciudat\u0103 cu alte fi\u0219iere, dup\u0103 care, la extragerea acestora prin intermediul bibliotecilor Rust, va fi ob\u021binut un con\u021binut diferit fa\u021b\u0103 de cel a\u0219teptat. <\/p>\n

De exemplu, un atacator poate \u00eenc\u0103rca o arhiv\u0103 modificat\u0103 \u00een depozitul PyPI, care va trece verificarea pe baza analizei con\u021binutului arhivei principale, con\u021bin\u00e2nd un fi\u0219ier legitim pyproject.toml. Atunci c\u00e2nd acest pachet este procesat prin utilitarul uv, fi\u0219ierul legitim pyproject.toml va fi \u00eenlocuit cu o versiune mali\u021bioas\u0103 din arhiva \u00eencorporat\u0103, care con\u021bine comenzi ce vor fi executate la construc\u021bia pe computerul dezvoltatorului sau \u00een sistemul de integrare continu\u0103. Similar, se poate organiza suprascrierea fi\u0219ierelor containerului la extragerea imaginii containerului prin intermediul instrumentarului testcontainers.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 async-tar, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-62518, \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TARmageddon), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u0444\u0430\u0439\u043b\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435\u0441\u044f \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c tar-\u0430\u0440\u0445\u0438\u0432\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0441\u0438\u0441\u0442\u0435\u043c \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":146044,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-146043","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een bibliotecile Rust pentru formatul TAR, care duce la extragerea fi\u0219ierelor din arhiva \u00eencorporat\u0103 | ProHoster","description":"\u00cen biblioteca scris\u0103 \u00een limbajul Rust async-tar, care ofer\u0103 func\u021bii pentru citirea \u0219i scrierea arhivelor tar, a fost descoperit\u0103 o vulnerabilitate (CVE-2025-62518, numele de cod TARmageddon), care permite la extragerea special\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Rust-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0430\u0442\u0430 TAR, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0440\u0445\u0438\u0432\u0430 | ProHoster","og:description":"\u0412 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 async-tar, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-62518, \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TARmageddon), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-21T21:12:43+00:00","article:modified_time":"2025-10-21T21:12:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"146043","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 15:29:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:29:20","updated":"2026-01-23 15:29:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/146043","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=146043"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/146043\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/146044"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=146043"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=146043"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=146043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}