{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Critical"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"perl-Archive-Tar security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for perl-Archive-Tar is now available for openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.\n\nSecurity Fix(es):\n\nArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.(CVE-2026-42496)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for perl-Archive-Tar is now available for openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Critical",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"perl-Archive-Tar",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2026-2678",
				"category":"self",
				"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2678"
			},
			{
				"summary":"CVE-2026-42496",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-42496&packageName=perl-Archive-Tar"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496"
			},
			{
				"summary":"openEuler-SA-2026-2678 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-2678.json"
			}
		],
		"title":"An update for perl-Archive-Tar is now available for openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4",
		"tracking":{
			"initial_release_date":"2026-06-18T16:17:35+08:00",
			"revision_history":[
				{
					"date":"2026-06-18T16:17:35+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2026-06-18T16:17:35+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2026-06-18T16:17:35+08:00",
			"id":"openEuler-SA-2026-2678",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"openEuler-24.03-LTS-SP1",
									"name":"openEuler-24.03-LTS-SP1"
								},
								"name":"openEuler-24.03-LTS-SP1",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"openEuler-24.03-LTS-SP3",
									"name":"openEuler-24.03-LTS-SP3"
								},
								"name":"openEuler-24.03-LTS-SP3",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4"
									},
									"product_id":"openEuler-20.03-LTS-SP4",
									"name":"openEuler-20.03-LTS-SP4"
								},
								"name":"openEuler-20.03-LTS-SP4",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"openEuler-22.03-LTS-SP4",
									"name":"openEuler-22.03-LTS-SP4"
								},
								"name":"openEuler-22.03-LTS-SP4",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"perl-Archive-Tar-3.02-3.oe2403sp1.src.rpm",
									"name":"perl-Archive-Tar-3.02-3.oe2403sp1.src.rpm"
								},
								"name":"perl-Archive-Tar-3.02-3.oe2403sp1.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"perl-Archive-Tar-3.02-3.oe2403sp3.src.rpm",
									"name":"perl-Archive-Tar-3.02-3.oe2403sp3.src.rpm"
								},
								"name":"perl-Archive-Tar-3.02-3.oe2403sp3.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4"
									},
									"product_id":"perl-Archive-Tar-2.38-2.oe2003sp4.src.rpm",
									"name":"perl-Archive-Tar-2.38-2.oe2003sp4.src.rpm"
								},
								"name":"perl-Archive-Tar-2.38-2.oe2003sp4.src.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"perl-Archive-Tar-2.40-4.oe2203sp4.src.rpm",
									"name":"perl-Archive-Tar-2.40-4.oe2203sp4.src.rpm"
								},
								"name":"perl-Archive-Tar-2.40-4.oe2203sp4.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"perl-Archive-Tar-3.02-3.oe2403sp1.noarch.rpm",
									"name":"perl-Archive-Tar-3.02-3.oe2403sp1.noarch.rpm"
								},
								"name":"perl-Archive-Tar-3.02-3.oe2403sp1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch.rpm",
									"name":"perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch.rpm"
								},
								"name":"perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"perl-Archive-Tar-3.02-3.oe2403sp3.noarch.rpm",
									"name":"perl-Archive-Tar-3.02-3.oe2403sp3.noarch.rpm"
								},
								"name":"perl-Archive-Tar-3.02-3.oe2403sp3.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3"
									},
									"product_id":"perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch.rpm",
									"name":"perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch.rpm"
								},
								"name":"perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4"
									},
									"product_id":"perl-Archive-Tar-2.38-2.oe2003sp4.noarch.rpm",
									"name":"perl-Archive-Tar-2.38-2.oe2003sp4.noarch.rpm"
								},
								"name":"perl-Archive-Tar-2.38-2.oe2003sp4.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:20.03-LTS-SP4"
									},
									"product_id":"perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch.rpm",
									"name":"perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch.rpm"
								},
								"name":"perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"perl-Archive-Tar-2.40-4.oe2203sp4.noarch.rpm",
									"name":"perl-Archive-Tar-2.40-4.oe2203sp4.noarch.rpm"
								},
								"name":"perl-Archive-Tar-2.40-4.oe2203sp4.noarch.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:22.03-LTS-SP4"
									},
									"product_id":"perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch.rpm",
									"name":"perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch.rpm"
								},
								"name":"perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"perl-Archive-Tar-3.02-3.oe2403sp1.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:perl-Archive-Tar-3.02-3.oe2403sp1.src",
					"name":"perl-Archive-Tar-3.02-3.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"perl-Archive-Tar-3.02-3.oe2403sp3.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:perl-Archive-Tar-3.02-3.oe2403sp3.src",
					"name":"perl-Archive-Tar-3.02-3.oe2403sp3.src as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP4",
				"product_reference":"perl-Archive-Tar-2.38-2.oe2003sp4.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP4:perl-Archive-Tar-2.38-2.oe2003sp4.src",
					"name":"perl-Archive-Tar-2.38-2.oe2003sp4.src as a component of openEuler-20.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"perl-Archive-Tar-2.40-4.oe2203sp4.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:perl-Archive-Tar-2.40-4.oe2203sp4.src",
					"name":"perl-Archive-Tar-2.40-4.oe2203sp4.src as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"perl-Archive-Tar-3.02-3.oe2403sp1.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:perl-Archive-Tar-3.02-3.oe2403sp1.noarch",
					"name":"perl-Archive-Tar-3.02-3.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch",
					"name":"perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"perl-Archive-Tar-3.02-3.oe2403sp3.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:perl-Archive-Tar-3.02-3.oe2403sp3.noarch",
					"name":"perl-Archive-Tar-3.02-3.oe2403sp3.noarch as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP3",
				"product_reference":"perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP3:perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch",
					"name":"perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch as a component of openEuler-24.03-LTS-SP3"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP4",
				"product_reference":"perl-Archive-Tar-2.38-2.oe2003sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP4:perl-Archive-Tar-2.38-2.oe2003sp4.noarch",
					"name":"perl-Archive-Tar-2.38-2.oe2003sp4.noarch as a component of openEuler-20.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-20.03-LTS-SP4",
				"product_reference":"perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-20.03-LTS-SP4:perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch",
					"name":"perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch as a component of openEuler-20.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"perl-Archive-Tar-2.40-4.oe2203sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:perl-Archive-Tar-2.40-4.oe2203sp4.noarch",
					"name":"perl-Archive-Tar-2.40-4.oe2203sp4.noarch as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-22.03-LTS-SP4",
				"product_reference":"perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-22.03-LTS-SP4:perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch",
					"name":"perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch as a component of openEuler-22.03-LTS-SP4"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2026-42496",
			"notes":[
				{
					"text":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS-SP1:perl-Archive-Tar-3.02-3.oe2403sp1.src",
					"openEuler-24.03-LTS-SP3:perl-Archive-Tar-3.02-3.oe2403sp3.src",
					"openEuler-20.03-LTS-SP4:perl-Archive-Tar-2.38-2.oe2003sp4.src",
					"openEuler-22.03-LTS-SP4:perl-Archive-Tar-2.40-4.oe2203sp4.src",
					"openEuler-24.03-LTS-SP1:perl-Archive-Tar-3.02-3.oe2403sp1.noarch",
					"openEuler-24.03-LTS-SP1:perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch",
					"openEuler-24.03-LTS-SP3:perl-Archive-Tar-3.02-3.oe2403sp3.noarch",
					"openEuler-24.03-LTS-SP3:perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch",
					"openEuler-20.03-LTS-SP4:perl-Archive-Tar-2.38-2.oe2003sp4.noarch",
					"openEuler-20.03-LTS-SP4:perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch",
					"openEuler-22.03-LTS-SP4:perl-Archive-Tar-2.40-4.oe2203sp4.noarch",
					"openEuler-22.03-LTS-SP4:perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS-SP1:perl-Archive-Tar-3.02-3.oe2403sp1.src",
						"openEuler-24.03-LTS-SP3:perl-Archive-Tar-3.02-3.oe2403sp3.src",
						"openEuler-20.03-LTS-SP4:perl-Archive-Tar-2.38-2.oe2003sp4.src",
						"openEuler-22.03-LTS-SP4:perl-Archive-Tar-2.40-4.oe2203sp4.src",
						"openEuler-24.03-LTS-SP1:perl-Archive-Tar-3.02-3.oe2403sp1.noarch",
						"openEuler-24.03-LTS-SP1:perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch",
						"openEuler-24.03-LTS-SP3:perl-Archive-Tar-3.02-3.oe2403sp3.noarch",
						"openEuler-24.03-LTS-SP3:perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch",
						"openEuler-20.03-LTS-SP4:perl-Archive-Tar-2.38-2.oe2003sp4.noarch",
						"openEuler-20.03-LTS-SP4:perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch",
						"openEuler-22.03-LTS-SP4:perl-Archive-Tar-2.40-4.oe2203sp4.noarch",
						"openEuler-22.03-LTS-SP4:perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch"
					],
					"details":"perl-Archive-Tar security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2678"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"CRITICAL",
						"baseScore":9.1,
						"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS-SP1:perl-Archive-Tar-3.02-3.oe2403sp1.src",
						"openEuler-24.03-LTS-SP3:perl-Archive-Tar-3.02-3.oe2403sp3.src",
						"openEuler-20.03-LTS-SP4:perl-Archive-Tar-2.38-2.oe2003sp4.src",
						"openEuler-22.03-LTS-SP4:perl-Archive-Tar-2.40-4.oe2203sp4.src",
						"openEuler-24.03-LTS-SP1:perl-Archive-Tar-3.02-3.oe2403sp1.noarch",
						"openEuler-24.03-LTS-SP1:perl-Archive-Tar-help-3.02-3.oe2403sp1.noarch",
						"openEuler-24.03-LTS-SP3:perl-Archive-Tar-3.02-3.oe2403sp3.noarch",
						"openEuler-24.03-LTS-SP3:perl-Archive-Tar-help-3.02-3.oe2403sp3.noarch",
						"openEuler-20.03-LTS-SP4:perl-Archive-Tar-2.38-2.oe2003sp4.noarch",
						"openEuler-20.03-LTS-SP4:perl-Archive-Tar-help-2.38-2.oe2003sp4.noarch",
						"openEuler-22.03-LTS-SP4:perl-Archive-Tar-2.40-4.oe2203sp4.noarch",
						"openEuler-22.03-LTS-SP4:perl-Archive-Tar-help-2.40-4.oe2203sp4.noarch"
					]
				}
			],
			"threats":[
				{
					"details":"Critical",
					"category":"impact"
				}
			],
			"title":"CVE-2026-42496"
		}
	]
}