{"id":146043,"date":"2025-10-21T23:12:42","date_gmt":"2025-10-21T21:12:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva"},"modified":"2025-10-21T23:12:42","modified_gmt":"2025-10-21T21:12:43","slug":"uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","title":{"rendered":"Zranite\u013enos\u0165 v Rust kni\u017eniciach pre form\u00e1t TAR, ktor\u00e1 vedie k rozbaleniu s\u00faborov z vn\u00fatorn\u00e9ho arch\u00edvu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V kni\u017enici async-tar nap\u00edsanej v jazyku Rust, ktor\u00e1 poskytuje funkcie na \u010d\u00edtanie a z\u00e1pis tar arch\u00edvov, bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2025-62518, k\u00f3dov\u00e9 meno TARmageddon), ktor\u00e1 umo\u017e\u0148uje pri rozba\u013eovan\u00ed \u0161peci\u00e1lne upraven\u00e9ho tar arch\u00edvu nielen extrahova\u0165 s\u00fabory v \u0148om obsiahnut\u00e9, ale aj s\u00fabory, ktor\u00e9 sa nach\u00e1dzaj\u00fa vo vnorenom tar arch\u00edve. Zranite\u013enos\u0165 m\u00f4\u017ee by\u0165 pou\u017eit\u00e1 na ob\u00eddenie syst\u00e9mov overovania arch\u00edvov a rozbalenie s\u00faborov, pre ktor\u00e9 nebola vykonan\u00e1 kontrola. <\/p>\n

Zranite\u013enos\u0165 sa taktie\u017e prejavuje vo fork\u00e1ch kni\u017enice async-tar, ako s\u00fa tokio-tar, krata-tokio-tar a astral-tokio-tar, ako aj v utilit\u00e1ch postaven\u00fdch na ich z\u00e1klade, napr\u00edklad v bal\u00ed\u010dkovom mana\u017e\u00e9ri uv, vyv\u00edjanom ako vysoko v\u00fdkonn\u00e1 n\u00e1hrada za \u201epip\u201c pre projekty v programovacom jazyku Python. Medzi popul\u00e1rne projekty, ktor\u00e9 pou\u017e\u00edvaj\u00fa zranite\u013en\u00e9 kni\u017enice, patr\u00ed aj n\u00e1stroj testcontainers na sp\u00fa\u0161\u0165anie dockerov\u00fdch kontajnerov a WebAssembly runtime wasmCloud. V repozit\u00e1ri crates.is za posledn\u00fdch 90 dn\u00ed kni\u017enica async-tar zaznamenala 1,3 mili\u00f3na stiahnut\u00ed, tokio-tar \u2013 2,2 mili\u00f3na, testcontainers \u2013 2,9 mili\u00f3na. <\/p>\n

Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 nespr\u00e1vnym v\u00fdberom poz\u00edcie pri anal\u00fdze r\u00f4znych hodn\u00f4t ve\u013ekosti v hlavi\u010dk\u00e1ch ustar a PAX. V tar-arch\u00edvoch vo form\u00e1te PAX s\u00fa pre ka\u017ed\u00fd s\u00fabor v arch\u00edve uveden\u00e9 dve hlavi\u010dky \u2013 klasick\u00e1 ustar a roz\u0161\u00edren\u00e1 PAX. Probl\u00e9m je sp\u00f4soben\u00fd t\u00fdm, \u017ee zranite\u013en\u00e9 kni\u017enice pri dekomprimovan\u00ed s\u00faborov namiesto v\u00fdpo\u010dtu posunu na z\u00e1klade ve\u013ekosti z roz\u0161\u00edrenej hlavi\u010dky PAX, brali ve\u013ekos\u0165 z zastaranej hlavi\u010dky ustar. Pri nulovej hodnote ve\u013ekosti v hlavi\u010dke ustar, obsah nasleduj\u00faceho s\u00faboru bol spracov\u00e1van\u00fd ako platn\u00fd blok TAR-hlavi\u010diek pre nasleduj\u00faci s\u00fabor.

\"Zranite\u013enos\u0165<\/center>
\"Zranite\u013enos\u0165<\/center> <\/p>\n

Na vykonanie \u00fatoku sta\u010d\u00ed vytvori\u0165 TAR arch\u00edv, v ktorom je v hlavi\u010dke ustar uveden\u00e1 nulov\u00e1 ve\u013ekos\u0165 a v hlavi\u010dke pre form\u00e1t PAX aktu\u00e1lna ve\u013ekos\u0165, \u010do sp\u00f4sob\u00ed, \u017ee obsah s\u00faboru s in\u00fdm tar arch\u00edvom bude spracovan\u00fd ako s\u00fa\u010das\u0165 hlavn\u00e9ho arch\u00edvu. Pr\u00edklad k\u00f3du na vytvorenie tak\u00fdchto arch\u00edvov je umiestnen\u00fd na GitHub. Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 v vydaniach tokio-tar 0.5.6 a uv 0.9.5. Pre ostatn\u00e9 kni\u017enice opravy zatia\u013e neboli zverejnen\u00e9, ale pre astral-tokio-tar, async-tar a krata-tokio-tar boli pripraven\u00e9 samostatn\u00e9 z\u00e1platy. <\/p>\n

Zranite\u013enosti v kni\u017eniciach boli ohodnoten\u00e9 na \u00farove\u0148 nebezpe\u010denstva 8.1 z 10, preto\u017ee probl\u00e9m m\u00f4\u017ee by\u0165 vyu\u017eit\u00fd na prep\u00edsanie rozba\u013eovan\u00fdch s\u00faborov (v zranite\u013en\u00fdch implement\u00e1ci\u00e1ch bud\u00fa rozbalen\u00e9 in\u00e9 s\u00fabory, ako boli vidite\u013en\u00e9 v arch\u00edve). Z\u00e1rove\u0148 bola zranite\u013enos\u0165 v bal\u00edkovom mana\u017e\u00e9ri uv ozna\u010den\u00e1 ako nebezpe\u010dn\u00e1, preto\u017ee ak \u00fato\u010dn\u00edk m\u00f4\u017ee ovplyvni\u0165 obsah p\u00f4vodn\u00e9ho arch\u00edvu, nem\u00e1 zmysel zlo\u017ei\u0165 \u00fatok a zneu\u017e\u00edva\u0165 zranite\u013enos\u0165 cez vnoren\u00fd arch\u00edv, ke\u010f m\u00f4\u017ee dosiahnu\u0165 vykonanie k\u00f3du prostredn\u00edctvom skriptov vo hlavnom arch\u00edve. <\/p>\n

V\u00fdskumn\u00edci, ktor\u00ed odhalili zranite\u013enos\u0165, navrhli nieko\u013eko hypotetick\u00fdch sc\u00e9nari\u00f3w \u00fatokov, ktor\u00e9 umo\u017e\u0148uj\u00fa ob\u00eds\u0165 bezpe\u010dnostn\u00e9 kontroly a dosiahnu\u0165 vykonanie k\u00f3du prostredn\u00edctvom v\u00fdmeny konfigura\u010dn\u00fdch s\u00faborov alebo z\u00e1sahu do procesu zostavovania. Predpoklad\u00e1 sa, \u017ee zaslan\u00fd arch\u00edv prejde automatizovanou kontrolou bezpe\u010dnostn\u00fdm skenerom a ru\u010dn\u00fdm auditom, po\u010das ktor\u00e9ho rev\u00edzor nezaznamen\u00e1 podivn\u00fd vnoren\u00fd arch\u00edv s in\u00fdmi s\u00fabormi, a potom pri rozba\u013eovan\u00ed pomocou kni\u017en\u00edc Rust z arch\u00edvu bude extrahovan\u00fd in\u00fd obsah, ako sa o\u010dak\u00e1valo. <\/p>\n

Napr\u00edklad, \u00fato\u010dn\u00edk m\u00f4\u017ee nahra\u0165 modifikovan\u00fd arch\u00edv do repozit\u00e1ra PyPI, ktor\u00fd prejde kontrolou na z\u00e1klade anal\u00fdzy obsahu hlavn\u00e9ho arch\u00edvu obsahuj\u00faceho legit\u00edmny s\u00fabor pyproject.toml. Pri spracovan\u00ed tohto bal\u00edka pomocou n\u00e1stroja uv bude legit\u00edmny pyproject.toml nahraden\u00fd \u0161kodlivou variantou z vnoren\u00e9ho arch\u00edvu, ktor\u00e1 obsahuje pr\u00edkazy, ktor\u00e9 bud\u00fa vykonan\u00e9 pri zostaven\u00ed na po\u010d\u00edta\u010di v\u00fdvoj\u00e1ra alebo v syst\u00e9me kontinu\u00e1lnej integr\u00e1cie. Rovnako tak je mo\u017en\u00e9 organizova\u0165 prep\u00edsanie s\u00faborov kontajnera pri extrakcii obrazu kontajnera pomocou n\u00e1strojov testcontainers.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 async-tar, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-62518, \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TARmageddon), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e tar-\u0430\u0440\u0445\u0438\u0432\u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u0432\u043b\u0435\u0447\u044c \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0435 \u0432 \u043d\u0451\u043c \u0444\u0430\u0439\u043b\u044b, \u043d\u043e \u0438 \u0444\u0430\u0439\u043b\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435\u0441\u044f \u0432\u043e \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u043c tar-\u0430\u0440\u0445\u0438\u0432\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0441\u0438\u0441\u0442\u0435\u043c \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0430\u0440\u0445\u0438\u0432\u043e\u0432 \u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432, \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":146044,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-146043","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v Rust-kni\u017eniciach pre form\u00e1t TAR, ved\u00faca k rozba\u013eovaniu s\u00faborov z vnoren\u00e9ho arch\u00edvu | ProHoster","description":"V kni\u017enici nap\u00edsanej v jazyku Rust async-tar, ktor\u00e1 poskytuje funkcie na \u010d\u00edtanie a p\u00edsanie tar-arch\u00edvov, bola identifikovan\u00e1 zranite\u013enos\u0165 (CVE-2025-62518, k\u00f3dov\u00e9 meno TARmageddon), ktor\u00e1 umo\u017e\u0148uje pri rozba\u013eovan\u00ed \u0161peci\u00e1lne.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Rust-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0430\u0442\u0430 TAR, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0444\u0430\u0439\u043b\u043e\u0432 \u0438\u0437 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0440\u0445\u0438\u0432\u0430 | ProHoster","og:description":"\u0412 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 async-tar, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 tar-\u0430\u0440\u0445\u0438\u0432\u043e\u0432, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-62518, \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f TARmageddon), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-rust-bibliotekah-dlya-formata-tar-privodyashhaya-k-raspakovke-fajlov-iz-vlozhennogo-arhiva","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-21T21:12:43+00:00","article:modified_time":"2025-10-21T21:12:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"146043","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 15:29:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:29:20","updated":"2026-01-23 15:29:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/146043","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=146043"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/146043\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/146044"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=146043"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=146043"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=146043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}