Red Hat tar Update Fixes Four RHEL 8 Flaws
Tech GuruQuick Answer
Red Hat's RHSA-2026:70390 updates RHEL 8 tar to 1.30-13.el8_10 for four archive-extraction and restore flaws. The risks include writes outside the intended destination and hidden file injection. Update the actual tar binary used by backup, restore and import jobs, including packaged copies in job images.
Confirm Scope And Apply The Supported Fix
What to do now: Locate tar binaries used by automated jobs, identify incremental restores and untrusted-archive handling, and install the matching Red Hat RPM. Test recovery using non-sensitive fixtures in an isolated environment.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8 tar packages |
|---|---|
| Advisory | RHSA-2026:70390 |
| CVEs | CVE-2025-45582, CVE-2026-18477, CVE-2026-18508, CVE-2026-5704 |
| Authoritative release date | 2026-09-22 19:17:00 UTC |
| CSAF generation time (historical snapshot) | 2026-09-22 21:30:08 UTC |
| Affected versions | The advisory's RHEL 8 tar RPMs before 1.30-13.el8_10, matched to the installed repository and architecture. |
| Fixed version | tar 1.30-13.el8_10 |
| CVSS base score | 4.4 / 5.0 / 5.6 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2025-45582 uses two archives extracted into the same directory: a symlink from the first can redirect writes from the second. CVE-2026-5704 concerns crafted archives that introduce files not exposed by pre-extraction inspection.
CVE-2026-18477 is a race in incremental restore rename handling. An attacker needs write access to backed-up content and access to the restore system, but need not alter the archive. CVE-2026-18508 affects hardlink targets with --one-top-level; combined with a preexisting symlink, a crafted archive can write outside that directory. Ordinary extraction is not affected by that specific option-boundary flaw, but the other CVEs still require assessment.
What To Validate Now
- Inventory. Locate RHEL 8 tar packages deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match the complete Red Hat package build, including its release suffix, rather than the upstream 1.30 version alone. Record incremental-backup options and use of
--one-top-levelin scripts. - Remediate. Apply tar 1.30-13.el8_10 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm each job invokes the updated binary, then run approved archive listing, extraction and incremental recovery fixtures. Check destination contents and permissions, not just the exit status.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Do not treat pre-extraction listing, a fresh directory, or --one-top-level alone as a security boundary for these flaws. In particular, Red Hat says a fresh directory and avoiding -P do not mitigate the incremental-restore race. Keep untrusted archives away from privileged production restore paths.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
