Forking confusing: Vulnerable Rust crate exposes uv Python packager

A vulnerability in the popular Rust crate async-tar has affected the fast uv Python package manager, which uses a forked version that's now patched – but the most widely downloaded version remains unfixed. The vulnerability is an error in the header parsing code that allows an attacker to hide additional files in a tar archive, discovered by a team at secure computing company Edera. The tar format can support both ustar (Unix Standard TAR) and pax headers, the latter was added as an extension to tar decades ago. When a file entry has both ustar and pax headers, the code advances the stream position based on the ustar size, often zero, rather than the pax size, which should override it. This means it may interpret file content as a tar header, enabling smuggled files. Edera stated that this enables file overwriting attacks, supply chain attacks "via build system and package manager exploitation," and bypass of BOM (bill of materials) security scanning. The normal disclosure pattern for a vulnerability is that maintainers are informed in advance to create patches before the issue is widely known. In this case, though, there are several important forks of async-tar. The version used by uv is astral-tokio-tar, which, the readme states, "is a fork of edera-dev/tokio-tar, which was a fork of vorot93/tokio-tar, which was a fork of dignifiedquire/async-tar, which is based on alexcrichton/tar-rs." The most popular tokio-tar crate has not been fixed, and the only fixed version in this ...