Release v1.4.5 - #747
Open
hmushi wants to merge 1 commit into
Open
Conversation
Bump tar crate from 0.4.43 to 0.4.45 to address two vulnerabilities in the bundled tar archive library: - CVE-2026-33055 / RUSTSEC-2026-0068: conditional PAX size header handling inconsistent with other tar parsers - CVE-2026-33056 / RUSTSEC-2026-0067: symlink-based chmod escape outside the extraction root in unpack_dir() Also picks up the five commits that have landed on main since v1.4.4 (Rust 1.92 bump, Dockerfile cleanups, enclave_build error reporting). Signed-off-by: Mushahid Hussain <hmushi@amazon.co.uk>
jhnberg
approved these changes
May 5, 2026
Contributor
|
what will be done about |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release v1.4.5. Primary change is bumping the
tarcrate from0.4.43to0.4.45inenclave_build/to address two vulnerabilities in the bundled tar archive library:chmodescape outside the extraction root inunpack_dir().Both are fixed in
tar0.4.45.The release also rolls up the five commits that have landed on
mainsince v1.4.4:scripts/bump-rust-version.sh: switch to two-part versioningtools/Dockerfile: build openssl silentlyenclave_build: always print errors when handling builder streamsFiles changed
enclave_build/Cargo.toml—tar = "0.4.40"→tar = "0.4.45"Cargo.toml—version = "1.4.4"→version = "1.4.5"Cargo.lock— regenerated (minimal diff: onlytar+nitro-cliversion bumps, schema v3 preserved)SPECS/aws-nitro-enclaves-cli.spec—Version: 1.4.5, new1.4.5-0changelog entrysources— regenerated viamake update-crates-dependencies(new vendored tarball SHA1)THIRD_PARTY_LICENSES_RUST_CRATES.html— regenerated viamake update-third-party-licenses-rust-crates-html(reflectstar 0.4.45)Verification
cargo build --workspace --release— clean.cargo test --workspace --lib --bins -- --test-threads=1— 72/72 pass.cargo audit— bothRUSTSEC-2026-0067andRUSTSEC-2026-0068no longer appear; diff againstmainconfirms exactly those two advisories are removed and no new ones are introduced.crates-dependencies/tar/Cargo.tomlconfirmsversion = "0.4.45".