Hi Collin, On Fri, Nov 06, 2026 at 08:59:42AM -0800, Collin Funk wrote: > Pavel Cahyna <[email protected]> writes: > > > Hello and sorry for the late reply, thank you for the report. By the way: > > > > On Sat, Oct 31, 2026 at 07:20:29AM +0000, apex-security-research wrote: > > > >> There is no CVE for this root; CVE-2026-5704 is the typeflag one. I am > >> happy to > >> request one, or to leave it to you. If one is requested, Vahagn Vardanian > >> reported this root first and should be named as the reporter. > > > > Not sure what you mean by "for this root", but FYI we (Red Hat) reserved > > CVE-2026-18082 for this problem that Vahagn Vardanian found, it is just > > not published yet, so you don't see it. I believe the severity should be > > same as for CVE-2026-5704, which has a very similar impact, I would not > > call it a RCE (contrary to the original report). > > > > I am not a maintainer of GNU tar so I can not comment on the suitability > > of the patches for inclusion. > > Did Red Hat confirm the findings posted by Vahagn Vardanian before > assigning the CVE? I am not a GNU tar maintainer, but I follow most of > the messages posted on list. > > I found that his report contained a ton of slop, as I mentioned on > oss-security [1].
I saw your oss-security post and thank you a lot for the analysis. While the report contained a ton of slop, this part was unfortunately real (although written in a too grandiose way, i.e. claiming a RCE). I let AI generate a reproducer (while AI reports are often slop, it is usually pretty good at writing reproducers) and verified it works before assigning the CVE. See: /tmp/test_extract$ tar -tf ~/miscsrc/tar/exploit.tar .cache .gitignore /tmp/test_extract$ tar -tvf ~/miscsrc/tar/exploit.tar -rw-r--r-- 0/0 4096 1970-01-01 01:00 .cache -rw-r--r-- 0/0 1024 1970-01-01 01:00 .gitignore /tmp/test_extract$ tar -xvf ~/miscsrc/tar/exploit.tar .cache Makefile /tmp/test_extract$ ls -A .cache Makefile Regards, Pavel > [1] https://seclists.org/oss-sec/2026/q2/108
