-
Mon Aug 24 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-13
- Backport upstream patches for CVE-2026-18477, fixes a bug
where incremental restore with cyclic renames between backups
may create a temporary directory at an archive-controlled path
outside the extraction tree.
The fix for CVE-2025-45582 already prevents exploiting
this problem, so it is more a correctness and hardening change.
-
Fri Aug 21 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-12
- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)
- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)
Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).
- Upstream fix for build with libacl 2.4.0
-
Mon Feb 23 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-11
- Add upstream patch to improve error message for --one-top-level
with absolute path (unsupported as a result of CVE-2025-45582 fix)
-
Mon Jan 12 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-10
- added "padding with zeros" info message (#2089298)
- do not report disk error as file shrank (#2089316)
- upstream fix for savannah bug 64581, commit 51142180
(crash with TAR_OPTIONS)
- Backport fix for regression in the --no-overwrite-dir option
Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html
-
Fri Dec 19 2025 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-9
- Fix a tiny mistake in the last patch affecting hardling extraction
(w/o visible consequences)
-
Fri Dec 05 2025 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-8
- Backport upstream changes to jailify extraction directory
Includes related gnulib changes to add openat2
Fixes CVE-2025-45582
-
Tue Feb 04 2025 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-7
- Backport upstream fix for savannah bug 65838, upstream commit 1e6ce98e
-
Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 2:1.35-5
- Bump release for October 2024 mass rebuild:
Resolves: RHEL-64018
-
Mon Jun 24 2024 Troy Dawson <tdawson@redhat.com> - 2:1.35-4
- Bump release for June 2024 mass rebuild
-
Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2:1.35-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild