-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability identified as GHSA-w476-p2h3-79g9 in uv is due to a flaw in a transitive dependency, the tar crate (also known as tar-rs). The vulnerability, tracked as CVE-2024-36043 in the tar crate, lies in the handling of PAX headers that override file sizes during tar extraction.
The patch for uv, seen in commit ae450662d1546e9853f67a8c61a506d3a892d963, is a dependency update. Specifically, it bumps the version of astral-tokio-tar from 0.5.5 to 0.5.6. This new version of astral-tokio-tar depends on the patched version of the tar crate (0.4.40 or newer), which contains the fix for the underlying vulnerability.
The vulnerable function is tar::Entry::read, located in src/entry.rs of the tar-rs repository. This function implements the Read trait for tar entries. During exploitation, a specially crafted tar archive with a malicious PAX header would be processed. When uv attempts to install a package from this tar archive, it would invoke the vulnerable tar::Entry::read function, leading to the incorrect extraction of the file content. Therefore, tar::Entry::read would appear in a runtime profile when the vulnerability is triggered.
tar::Entry::readsrc/entry.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| uv | pip | <= 0.9.4 | 0.9.5 |
Ongoing coverage of React2Shell