Skip to content
OpenAdvisories
High ELSA-2026-30852 1 CVE

Important: perl-Archive-Tar security update (Oracle Linux 8)

Published Jun 29, 2026 · Updated Jun 29, 2026

Ecosystem: Oracle Linux

Summary

[2.30-2]
- Fix CVE-2026-42496: validate symlink and hardlink targets in secure
extract mode
- Resolves: RHEL-181654

[2.30-1]
- 2.30 bump

[2.28-1]
- 2.28 bump
- Fixes CVE-2018-12015 (directory traversal) (bug #1588761)

[2.26-6]
- Do not run optional test on RHEL

[2.26-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.26-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.26-3]
- Perl 5.26 re-rebuild of bootstrapped packages

[2.26-2]
- Perl 5.26 rebuild

[2.26-1]
- 2.26 bump

[2.24-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 perl-Archive-Tar 0:2.30-2.el8_10

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-42496

    Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

    Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The …

    BINGOS Archive::Tar perl perl Debian Ubuntu Azure Linux Alpine