ELSA-2026-70390

ELSA-2026-70390 - tar security, bug fix, and enhancement update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-09-23

Description

[2:1.30-13]
- Backport upstream fix for CVE-2026-5704 (file injection hidden from -t)
- Fix --one-top-level with absolute path (broken by the CVE-2025-45582 fix)
Also fixes CVE-2026-18508 (escape from --one-top-level via hardlinks).
- Upstream fix for build with libacl 2.4.0
- Backport upstream patches for CVE-2026-18477, fixes a bug
where incremental restore with cyclic renames between backups
may create a temporary directory at an archive-controlled path
outside the extraction tree.
The fix for CVE-2025-45582 already prevents exploiting
this problem, so it is more a correctness and hardening change.

[2:1.30-12]
- Backport upstream changes to jailify extraction directory
Includes related gnulib changes to add openat2
Fixes CVE-2025-45582

Related CVEs

CVE-2025-45582

CVE-2026-18477

CVE-2026-18508

CVE-2026-5704

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	tar-1.30-13.el8_10.src.rpm	cc5a8f853b4599dcae93b8b534f8c850e668bbf99b533dddeac9cd18f87384b5	-	ol8_aarch64_baseos_latest
	tar-1.30-13.el8_10.src.rpm	cc5a8f853b4599dcae93b8b534f8c850e668bbf99b533dddeac9cd18f87384b5	-	ol8_aarch64_u10_baseos_patch
	tar-1.30-13.el8_10.aarch64.rpm	b77d1f94ad838a357d030832619fe45dfb53d2d2d6cc03c1e0dc1d59fab6f521	-	ol8_aarch64_baseos_latest
	tar-1.30-13.el8_10.aarch64.rpm	b77d1f94ad838a357d030832619fe45dfb53d2d2d6cc03c1e0dc1d59fab6f521	-	ol8_aarch64_u10_baseos_patch
Oracle Linux 8 (x86_64)	tar-1.30-13.el8_10.src.rpm	cc5a8f853b4599dcae93b8b534f8c850e668bbf99b533dddeac9cd18f87384b5	-	ol8_x86_64_baseos_latest
	tar-1.30-13.el8_10.src.rpm	cc5a8f853b4599dcae93b8b534f8c850e668bbf99b533dddeac9cd18f87384b5	-	ol8_x86_64_u10_baseos_patch
	tar-1.30-13.el8_10.x86_64.rpm	2c1de5b670313550e8a420028daa30402bc25fe9a1fd223570a2a17d60684878	-	ol8_x86_64_baseos_latest
	tar-1.30-13.el8_10.x86_64.rpm	2c1de5b670313550e8a420028daa30402bc25fe9a1fd223570a2a17d60684878	-	ol8_x86_64_u10_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team