Control: tags -1 + fixed-upstream Hi,
Upstream has no commits or release mentioning these CVE IDs. However, Red Hat shipped fixes for both on tar 1.35 (RHSA-2026:61586 for RHEL 10; RHEL 8 and 9 too), and the CentOS Stream c10s tar.spec lists the upstream commits behind each patch: CVE-2026-18477 (incremental 'X' dumpdir entries): tar-1.35-CVE-2026-18477.patch = upstream 0714d2f082 tar: strip '/' from incremental 'X' entries d479b2cc91 Use mkdtempat instead of mkdtemp b17665b2c0 Add tests for cyclic renames (rename08, rename09) CVE-2026-18508 (--one-top-level and hard link targets): The spec says this is fixed "by the way" by tar-1.35-fix-absolute-one-top-level.patch, upstream bfc3346394, b4fc9ca136, 67c8dff696, 55e8233438, 0470c109c0, 1b91f5f66f, 325b899214, 1980e032af, e335e2c8b1 and part of 941f62b2 That patch is layered on RHEL's tar-1.35-CVE-2025-45582.patch (the openat2/fdbase extraction rework) and tar-1.35-tar-one-top-level-DIR-must-be-relative.patch. https://www.google.com/url?q=https://gitlab.com/redhat/centos-stream/rpms/tar/-/tree/c10s&source=gmail&ust=1793769361552000&sa=E What I found trying these on Debian's tree (1.35+dfsg-6 with debian/patches; -7 only adds a src/sparse.c change, so the same applies): - The CVE-2026-18477 patch applies textually (only the NEWS hunk fails) but does not build. src/incremen.c now calls fdbase() and checks BADFD, both from the CVE-2025-45582 rework, which Debian doesn't carry and the tracker marks as disputed. So either that infrastructure comes too, or the mkdtempat() call needs adapting to 1.35's chdir_fd handling. I haven't attempted that adaptation. - The CVE-2026-18508 patch depends on the same rework and fails in several src/extract.c hunks. So neither is a drop-in backport. I'm sending this so whoever picks it up has the upstream commit mapping and knows about the fdbase dependency. (For CVE-2026-5704, #1132999: RHEL's tar-1.35-CVE-2026-5704.patch does apply to Debian 1.35 apart from test registration. With it, upstream's "skip file injection" (extrac32) and skipdir regression tests pass; they fail on 1.35+dfsg-6. The full test suite gives 220 passed / 27 skipped, against 217 / 27 unpatched. That may be useful to cross-check the debdiff already on that bug.) Thanks!
