#tarmageddon — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #tarmageddon, aggregated by home.social.
-
This episode of #OpenSourceSecurity I chat with Alex Zenla from Edera about the #TARmageddon vulnerability they found
I've coordinated a lot of vulnerabilities in my day, but never have I had to even think about something as difficult as this one. Alex fills us in on how it was found, what the coordination looked like, and some things to think about as we manage these incredibly complex supply chains
https://opensourcesecurity.io/2025/2025-12-tarmageddon-alex/
-
This episode of #OpenSourceSecurity I chat with Alex Zenla from Edera about the #TARmageddon vulnerability they found
I've coordinated a lot of vulnerabilities in my day, but never have I had to even think about something as difficult as this one. Alex fills us in on how it was found, what the coordination looked like, and some things to think about as we manage these incredibly complex supply chains
https://opensourcesecurity.io/2025/2025-12-tarmageddon-alex/
-
This episode of #OpenSourceSecurity I chat with Alex Zenla from Edera about the #TARmageddon vulnerability they found
I've coordinated a lot of vulnerabilities in my day, but never have I had to even think about something as difficult as this one. Alex fills us in on how it was found, what the coordination looked like, and some things to think about as we manage these incredibly complex supply chains
https://opensourcesecurity.io/2025/2025-12-tarmageddon-alex/
-
This episode of #OpenSourceSecurity I chat with Alex Zenla from Edera about the #TARmageddon vulnerability they found
I've coordinated a lot of vulnerabilities in my day, but never have I had to even think about something as difficult as this one. Alex fills us in on how it was found, what the coordination looked like, and some things to think about as we manage these incredibly complex supply chains
https://opensourcesecurity.io/2025/2025-12-tarmageddon-alex/
-
🪤 TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware
｢ In the worst-case scenario, this vulnerability has a severity of 8.1 (High) and can lead to Remote Code Execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends ｣
-
🪤 TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware
｢ In the worst-case scenario, this vulnerability has a severity of 8.1 (High) and can lead to Remote Code Execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends ｣
-
🪤 TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware
｢ In the worst-case scenario, this vulnerability has a severity of 8.1 (High) and can lead to Remote Code Execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends ｣
-
🪤 TARmageddon (CVE-2025-62518): RCE Vulnerability Highlights the Challenges of Open Source Abandonware
｢ In the worst-case scenario, this vulnerability has a severity of 8.1 (High) and can lead to Remote Code Execution (RCE) through file overwriting attacks, such as replacing configuration files or hijacking build backends ｣
-
Rust async tar libraries are affected by a High 8.1 severity vulnerability CVE-2025-62518 “TARmageddon” which allows potential RCE and supply-chain attacks.
https://forum.hashpwn.net/post/5906
#rust #cve_2025_62518 #TARmageddon #tar #cybersecurity #news #hashpwn
-
Rust async tar libraries are affected by a High 8.1 severity vulnerability CVE-2025-62518 “TARmageddon” which allows potential RCE and supply-chain attacks.
https://forum.hashpwn.net/post/5906
#rust #cve_2025_62518 #TARmageddon #tar #cybersecurity #news #hashpwn
-
Rust async tar libraries are affected by a High 8.1 severity vulnerability CVE-2025-62518 “TARmageddon” which allows potential RCE and supply-chain attacks.
https://forum.hashpwn.net/post/5906
#rust #cve_2025_62518 #TARmageddon #tar #cybersecurity #news #hashpwn
-
HAS RUST FALLEN INTO THE TAR PIT? Rust hacked ... Tarmageddon! #security #computer #rust #tokyo_tar #blocking_io #errtlings #bookcafe #hack #libraries #maintenance #archive_smuggling #tarmageddon #attack www.youtube.com/watch?v=tC08...
I Never Thought I’d See This -
HAS RUST FALLEN INTO THE TAR PIT? Rust hacked ... Tarmageddon! #security #computer #rust #tokyo_tar #blocking_io #errtlings #bookcafe #hack #libraries #maintenance #archive_smuggling #tarmageddon #attack www.youtube.com/watch?v=tC08...
I Never Thought I’d See This -
HAS RUST FALLEN INTO THE TAR PIT? Rust hacked ... Tarmageddon! #security #computer #rust #tokyo_tar #blocking_io #errtlings #bookcafe #hack #libraries #maintenance #archive_smuggling #tarmageddon #attack www.youtube.com/watch?v=tC08...
I Never Thought I’d See This -
So apparently #Tarmageddon is a thing…
While the RCE claim seems bullshit, going by what I’ve heard about it, it wouldn’t have shocked me, given how muchunsafepeople use in practice, but that isn’t the interesting thing here…
The notable thing is that this is in a widely used unmaintained dependency, making it the exact kind of issue I’ve been warning about for ages and one of the prime reasons I still can’t really get myself to use #Rust: Instead on focusing on a small number of well maintained, highly established packages like for example Boost (in C++), everything is its own crate, mirroring the hellscape that is node and when you complain about it, the defense is always version pinning.
Guess what: Version pinning prevents updates to newer versions that contain fixes and especially doesn’t help with unmaintained software!
Rust has a decent (but not perfect!) technical foundation, but the culture around it really is something that repels me every time… -
So apparently #Tarmageddon is a thing…
While the RCE claim seems bullshit, going by what I’ve heard about it, it wouldn’t have shocked me, given how muchunsafepeople use in practice, but that isn’t the interesting thing here…
The notable thing is that this is in a widely used unmaintained dependency, making it the exact kind of issue I’ve been warning about for ages and one of the prime reasons I still can’t really get myself to use #Rust: Instead on focusing on a small number of well maintained, highly established packages like for example Boost (in C++), everything is its own crate, mirroring the hellscape that is node and when you complain about it, the defense is always version pinning.
Guess what: Version pinning prevents updates to newer versions that contain fixes and especially doesn’t help with unmaintained software!
Rust has a decent (but not perfect!) technical foundation, but the culture around it really is something that repels me every time… -
So apparently #Tarmageddon is a thing…
While the RCE claim seems bullshit, going by what I’ve heard about it, it wouldn’t have shocked me, given how muchunsafepeople use in practice, but that isn’t the interesting thing here…
The notable thing is that this is in a widely used unmaintained dependency, making it the exact kind of issue I’ve been warning about for ages and one of the prime reasons I still can’t really get myself to use #Rust: Instead on focusing on a small number of well maintained, highly established packages like for example Boost (in C++), everything is its own crate, mirroring the hellscape that is node and when you complain about it, the defense is always version pinning.
Guess what: Version pinning prevents updates to newer versions that contain fixes and especially doesn’t help with unmaintained software!
Rust has a decent (but not perfect!) technical foundation, but the culture around it really is something that repels me every time… -
So apparently #Tarmageddon is a thing…
While the RCE claim seems bullshit, going by what I’ve heard about it, it wouldn’t have shocked me, given how muchunsafepeople use in practice, but that isn’t the interesting thing here…
The notable thing is that this is in a widely used unmaintained dependency, making it the exact kind of issue I’ve been warning about for ages and one of the prime reasons I still can’t really get myself to use #Rust: Instead on focusing on a small number of well maintained, highly established packages like for example Boost (in C++), everything is its own crate, mirroring the hellscape that is node and when you complain about it, the defense is always version pinning.
Guess what: Version pinning prevents updates to newer versions that contain fixes and especially doesn’t help with unmaintained software!
Rust has a decent (but not perfect!) technical foundation, but the culture around it really is something that repels me every time… -
Ah, the joys of #open source! 🤦♂️ #TARmageddon strikes with a #CVE number longer than a CVS receipt, proving once again that "free" code is never free from #hilarious mishaps! 🎉 Who knew #parsing #bugs could be this entertaining? 🙃
https://edera.dev/stories/tarmageddon #source #mishaps #HackerNews #ngated -
Ah, the joys of #open source! 🤦♂️ #TARmageddon strikes with a #CVE number longer than a CVS receipt, proving once again that "free" code is never free from #hilarious mishaps! 🎉 Who knew #parsing #bugs could be this entertaining? 🙃
https://edera.dev/stories/tarmageddon #source #mishaps #HackerNews #ngated -
Ah, the joys of #open source! 🤦♂️ #TARmageddon strikes with a #CVE number longer than a CVS receipt, proving once again that "free" code is never free from #hilarious mishaps! 🎉 Who knew #parsing #bugs could be this entertaining? 🙃
https://edera.dev/stories/tarmageddon #source #mishaps #HackerNews #ngated -
Ah, the joys of #open source! 🤦♂️ #TARmageddon strikes with a #CVE number longer than a CVS receipt, proving once again that "free" code is never free from #hilarious mishaps! 🎉 Who knew #parsing #bugs could be this entertaining? 🙃
https://edera.dev/stories/tarmageddon #source #mishaps #HackerNews #ngated -
Tarmageddon Open Source Abandonware
https://edera.dev/stories/tarmageddon
#HackerNews #Tarmageddon #Open #Source #Abandonware #Tarmageddon #OpenSource #Abandonware #SoftwareDevelopment #TechNews #OpenSourceCommunity
-
Tarmageddon Open Source Abandonware
https://edera.dev/stories/tarmageddon
#HackerNews #Tarmageddon #Open #Source #Abandonware #Tarmageddon #OpenSource #Abandonware #SoftwareDevelopment #TechNews #OpenSourceCommunity
-
Tarmageddon Open Source Abandonware
https://edera.dev/stories/tarmageddon
#HackerNews #Tarmageddon #Open #Source #Abandonware #Tarmageddon #OpenSource #Abandonware #SoftwareDevelopment #TechNews #OpenSourceCommunity
-
Tarmageddon Open Source Abandonware
https://edera.dev/stories/tarmageddon
#HackerNews #Tarmageddon #Open #Source #Abandonware #Tarmageddon #OpenSource #Abandonware #SoftwareDevelopment #TechNews #OpenSourceCommunity
-
Distro maintainers working on the #Tarmageddon / #CVE_2025_62518 you might like @niklaskorz work 💚.
He started to compile a list of software that includes one of the vulnerable crates in its dependency tree, based on the current state of #nixpkgs. You might find affected packages in your own repositories.
-
Distro maintainers working on the #Tarmageddon / #CVE_2025_62518 you might like @niklaskorz work 💚.
He started to compile a list of software that includes one of the vulnerable crates in its dependency tree, based on the current state of #nixpkgs. You might find affected packages in your own repositories.
-
Distro maintainers working on the #Tarmageddon / #CVE_2025_62518 you might like @niklaskorz work 💚.
He started to compile a list of software that includes one of the vulnerable crates in its dependency tree, based on the current state of #nixpkgs. You might find affected packages in your own repositories.
-
Distro maintainers working on the #Tarmageddon / #CVE_2025_62518 you might like @niklaskorz work 💚.
He started to compile a list of software that includes one of the vulnerable crates in its dependency tree, based on the current state of #nixpkgs. You might find affected packages in your own repositories.
-
🚨 TARmageddon (CVE-2025-62518) - astral-tokio-tar Vulnerable to PAX Header Desynchronization
https://secdb.nttzen.cloud/cve/alias/tarmageddonastral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
-
🚨 TARmageddon (CVE-2025-62518) - astral-tokio-tar Vulnerable to PAX Header Desynchronization
https://secdb.nttzen.cloud/cve/alias/tarmageddonastral-tokio-tar is a tar archive reading/writing library for async Rust. Versions of astral-tokio-tar prior to 0.5.6 contain a boundary parsing vulnerability that allows attackers to smuggle additional archive entries by exploiting inconsistent PAX/ustar header handling. When processing archives with PAX-extended headers containing size overrides, the parser incorrectly advances stream position based on ustar header size (often zero) instead of the PAX-specified size, causing it to interpret file content as legitimate tar headers. This issue has been patched in version 0.5.6. There are no workarounds.
-
Schwachstelle in #Rust-Library für #tar-Archive entdeckt | Developer https://www.heise.de/news/Schwachstelle-in-Rust-Library-fuer-tar-Archive-entdeckt-10793899.html #TARmageddon #Patchday
-
Schwachstelle in #Rust-Library für #tar-Archive entdeckt | Developer https://www.heise.de/news/Schwachstelle-in-Rust-Library-fuer-tar-Archive-entdeckt-10793899.html #TARmageddon #Patchday
-
Schwachstelle in #Rust-Library für #tar-Archive entdeckt | Developer https://www.heise.de/news/Schwachstelle-in-Rust-Library-fuer-tar-Archive-entdeckt-10793899.html #TARmageddon #Patchday
-
Schwachstelle in #Rust-Library für #tar-Archive entdeckt | Developer https://www.heise.de/news/Schwachstelle-in-Rust-Library-fuer-tar-Archive-entdeckt-10793899.html #TARmageddon #Patchday
-
A single abandoned Rust library sparked a security nightmare—TARmageddon is here. Is your supply chain ready to fend off remote code execution threats? Read on to find out how to safeguard your projects now.
#rustsecurity
#supplychainsecurity
#tarmageddon
#remotecodeexecution
#dependencysecurity -
A single abandoned Rust library sparked a security nightmare—TARmageddon is here. Is your supply chain ready to fend off remote code execution threats? Read on to find out how to safeguard your projects now.
#rustsecurity
#supplychainsecurity
#tarmageddon
#remotecodeexecution
#dependencysecurity -
A single abandoned Rust library sparked a security nightmare—TARmageddon is here. Is your supply chain ready to fend off remote code execution threats? Read on to find out how to safeguard your projects now.
#rustsecurity
#supplychainsecurity
#tarmageddon
#remotecodeexecution
#dependencysecurity -
A single abandoned Rust library sparked a security nightmare—TARmageddon is here. Is your supply chain ready to fend off remote code execution threats? Read on to find out how to safeguard your projects now.
#rustsecurity
#supplychainsecurity
#tarmageddon
#remotecodeexecution
#dependencysecurity -
TARmageddon Flaw in Popular Rust Library Leads to RCE https://www.securityweek.com/tarmageddon-flaw-in-popular-rust-library-leads-to-rce/ #Vulnerabilities #vulnerability #TARmageddon #Rust
-
TARmageddon Flaw in Popular Rust Library Leads to RCE https://www.securityweek.com/tarmageddon-flaw-in-popular-rust-library-leads-to-rce/ #Vulnerabilities #vulnerability #TARmageddon #Rust
-
TARmageddon Flaw in Popular Rust Library Leads to RCE https://www.securityweek.com/tarmageddon-flaw-in-popular-rust-library-leads-to-rce/ #Vulnerabilities #vulnerability #TARmageddon #Rust
-
While the bug in async-tar/tokio-tar dubbed #tarmageddon / CVE-2025-62518 is cool on a technical and code-correctness level, I'm calling bullshit on the #RCE claim. It's a severe overstatement that isn't backed by the advisory.
Processing a tar stream with a vulnerable version won't execute code on your computer. Even unpacking it to disk won't lead to RCE or overwritten configs.
The claim is that a security scanner would interpret the tar file differently. That's not what RCE means. #Rust
-
While the bug in async-tar/tokio-tar dubbed #tarmageddon / CVE-2025-62518 is cool on a technical and code-correctness level, I'm calling bullshit on the #RCE claim. It's a severe overstatement that isn't backed by the advisory.
Processing a tar stream with a vulnerable version won't execute code on your computer. Even unpacking it to disk won't lead to RCE or overwritten configs.
The claim is that a security scanner would interpret the tar file differently. That's not what RCE means. #Rust
-
While the bug in async-tar/tokio-tar dubbed #tarmageddon / CVE-2025-62518 is cool on a technical and code-correctness level, I'm calling bullshit on the #RCE claim. It's a severe overstatement that isn't backed by the advisory.
Processing a tar stream with a vulnerable version won't execute code on your computer. Even unpacking it to disk won't lead to RCE or overwritten configs.
The claim is that a security scanner would interpret the tar file differently. That's not what RCE means. #Rust
-
While the bug in async-tar/tokio-tar dubbed #tarmageddon / CVE-2025-62518 is cool on a technical and code-correctness level, I'm calling bullshit on the #RCE claim. It's a severe overstatement that isn't backed by the advisory.
Processing a tar stream with a vulnerable version won't execute code on your computer. Even unpacking it to disk won't lead to RCE or overwritten configs.
The claim is that a security scanner would interpret the tar file differently. That's not what RCE means. #Rust
-
Not quite #Tarmageddon, but another example of an unpleasant #anthropocene unconformity😠.
Recent #Targlomerate overlying #Lewisian reworked migmatites; so an age gap of getting on for 2 billion years🤪
Luckily this was an exception on an otherwise pristine #Hebridean coastline
-
Not quite #Tarmageddon, but another example of an unpleasant #anthropocene unconformity😠.
Recent #Targlomerate overlying #Lewisian reworked migmatites; so an age gap of getting on for 2 billion years🤪
Luckily this was an exception on an otherwise pristine #Hebridean coastline
-
Not quite #Tarmageddon, but another example of an unpleasant #anthropocene unconformity😠.
Recent #Targlomerate overlying #Lewisian reworked migmatites; so an age gap of getting on for 2 billion years🤪
Luckily this was an exception on an otherwise pristine #Hebridean coastline