Forking confusing: Vulnerable Rust crate exposes uv Python packager

A vulnerability in the popular Rust crate async-tar has affected the fast uv Python package manager, which uses a forked version that's now patched – but the most widely downloaded version remains unfixed. The vulnerability is an error in the header parsing code that allows an attacker to hide additional files in a tar archive …

[DarkwavePunk]

What?

What demonic level of abstraction is this horror? I remember when "tar" was just a useful command on SunOS for tape archive or a local filesystem facsimile thereof. What have we done?

[Anonymous Coward]

Re: What?

Cloud - ‘Someone else’s computer’

FOSS - ‘Someone else’s software’… hopefully they are still interested/alive.

[JimmyPage]

I thought Rust was the most perfect thing ?

I guess I should actually read some more

[Apocalypso - a cheery end to the world]

Iffy tars rather than tariff-y problems

(NT)

[beast666]

Rust is not fit for purpose.

[stiine]

I know, I know!!!

Forks of forks of forks, but which ones are patched?

Some of them, but none of them have the same patches applied.