[release-1.32] OCPBUGS-63772: Fix CVE-2025-58183: Update tar-split to v0.12.2 #9592

saschagrunert · 2025-11-13T11:37:19Z

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fixes CVE-2025-58183 by updating tar-split to v0.12.2.

CVE-2025-58183 is an unbounded allocation vulnerability in archive/tar when parsing GNU sparse map files. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory.

tar-split v0.12.2 includes the fix that caps sparse block data to 1 MiB (same limit as PAX headers).

OpenShift Version: 4.19

Which issue(s) this PR fixes:

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2407258

Fixes: https://issues.redhat.com/browse/OCPBUGS-63772

Special notes for your reviewer:

This PR updates:

go.mod with tar-split v0.12.2
go.sum
Vendored dependencies (vendor/)

The vulnerability affects CRI-O's container image layer extraction code path through containers/storage which uses tar-split (a vendored fork of Go's archive/tar).

Does this PR introduce a user-facing change?

Fixed CVE-2025-58183: Updated tar-split to v0.12.2 to fix unbounded memory allocation vulnerability when parsing malicious container images with GNU sparse tar files.

openshift-ci-robot · 2025-11-13T11:37:22Z

@saschagrunert: No Jira issue with key CVE-2025 exists in the tracker at https://issues.redhat.com/.
Once a valid jira issue is referenced in the title of this pull request, request a refresh with /jira refresh.

Details

In response to this:

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fixes CVE-2025-58183 by updating tar-split to v0.12.2.

CVE-2025-58183 is an unbounded allocation vulnerability in archive/tar when parsing GNU sparse map files. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory.

tar-split v0.12.2 includes the fix that caps sparse block data to 1 MiB (same limit as PAX headers).

OpenShift Version: 4.19

Which issue(s) this PR fixes:

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2407258

Related JIRA: https://issues.redhat.com/browse/OCPBUGS-63773

Special notes for your reviewer:

This PR updates:

go.mod with tar-split v0.12.2

go.sum

Vendored dependencies (vendor/)

The vulnerability affects CRI-O's container image layer extraction code path through containers/storage which uses tar-split (a vendored fork of Go's archive/tar).

Does this PR introduce a user-facing change?
Fixed CVE-2025-58183: Updated tar-split to v0.12.2 to fix unbounded memory allocation vulnerability when parsing malicious container images with GNU sparse tar files.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-11-13T11:37:49Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

CVE-2025-58183 is an unbounded allocation vulnerability in archive/tar when parsing GNU sparse map files. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. This update brings tar-split to v0.12.2 which includes the fix that caps sparse block data to 1 MiB (same limit as PAX headers). Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2407258 CVE: CVE-2025-58183 Signed-off-by: Sascha Grunert <[email protected]>

openshift-ci-robot · 2025-11-13T11:45:09Z

@saschagrunert: This pull request references Jira Issue OCPBUGS-63772, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-63772 to depend on a bug in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fixes CVE-2025-58183 by updating tar-split to v0.12.2.

CVE-2025-58183 is an unbounded allocation vulnerability in archive/tar when parsing GNU sparse map files. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory.

tar-split v0.12.2 includes the fix that caps sparse block data to 1 MiB (same limit as PAX headers).

OpenShift Version: 4.19

Which issue(s) this PR fixes:

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2407258

Related JIRA: https://issues.redhat.com/browse/OCPBUGS-63773

Special notes for your reviewer:

This PR updates:

go.mod with tar-split v0.12.2

go.sum

Vendored dependencies (vendor/)

The vulnerability affects CRI-O's container image layer extraction code path through containers/storage which uses tar-split (a vendored fork of Go's archive/tar).

Does this PR introduce a user-facing change?
Fixed CVE-2025-58183: Updated tar-split to v0.12.2 to fix unbounded memory allocation vulnerability when parsing malicious container images with GNU sparse tar files.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-11-13T11:47:56Z

@saschagrunert: This pull request references Jira Issue OCPBUGS-63771, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-63771 to depend on a bug in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fixes CVE-2025-58183 by updating tar-split to v0.12.2.

CVE-2025-58183 is an unbounded allocation vulnerability in archive/tar when parsing GNU sparse map files. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory.

tar-split v0.12.2 includes the fix that caps sparse block data to 1 MiB (same limit as PAX headers).

OpenShift Version: 4.19

Which issue(s) this PR fixes:

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2407258

Related JIRA: https://issues.redhat.com/browse/OCPBUGS-63773

Special notes for your reviewer:

This PR updates:

go.mod with tar-split v0.12.2

go.sum

Vendored dependencies (vendor/)

The vulnerability affects CRI-O's container image layer extraction code path through containers/storage which uses tar-split (a vendored fork of Go's archive/tar).

Does this PR introduce a user-facing change?
Fixed CVE-2025-58183: Updated tar-split to v0.12.2 to fix unbounded memory allocation vulnerability when parsing malicious container images with GNU sparse tar files.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2025-11-13T12:10:39Z

@saschagrunert: This pull request references Jira Issue OCPBUGS-63772, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-63772 to depend on a bug in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fixes CVE-2025-58183 by updating tar-split to v0.12.2.

CVE-2025-58183 is an unbounded allocation vulnerability in archive/tar when parsing GNU sparse map files. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory.

tar-split v0.12.2 includes the fix that caps sparse block data to 1 MiB (same limit as PAX headers).

OpenShift Version: 4.19

Which issue(s) this PR fixes:

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2407258

Fixes: https://issues.redhat.com/browse/OCPBUGS-63771

Special notes for your reviewer:

This PR updates:

go.mod with tar-split v0.12.2

go.sum

Vendored dependencies (vendor/)

The vulnerability affects CRI-O's container image layer extraction code path through containers/storage which uses tar-split (a vendored fork of Go's archive/tar).

Does this PR introduce a user-facing change?
Fixed CVE-2025-58183: Updated tar-split to v0.12.2 to fix unbounded memory allocation vulnerability when parsing malicious container images with GNU sparse tar files.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

saschagrunert · 2025-11-13T12:13:50Z

/jira refresh

openshift-ci-robot · 2025-11-13T12:13:55Z

@saschagrunert: This pull request references Jira Issue OCPBUGS-63772, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-63772 to depend on a bug in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

saschagrunert · 2025-11-13T12:26:48Z

/jira refresh

openshift-ci-robot · 2025-11-13T12:26:56Z

@saschagrunert: This pull request references Jira Issue OCPBUGS-63772, which is valid. The bug has been moved to the POST state.

5 validation(s) were run on this bug

bug is open, matching expected state (open)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-65574 is in the state Closed (Done), which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
bug has dependents

Requesting review from QA contact:
/cc @lyman9966

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-11-13T12:26:59Z

@openshift-ci-robot: GitHub didn't allow me to request PR reviews from the following users: lyman9966.

Note that only cri-o members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

@saschagrunert: This pull request references Jira Issue OCPBUGS-63772, which is valid. The bug has been moved to the POST state.

5 validation(s) were run on this bug

bug is open, matching expected state (open)

bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

release note text is set and does not match the template

dependent bug Jira Issue OCPBUGS-65574 is in the state Closed (Done), which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))

bug has dependents

Requesting review from QA contact:
/cc @lyman9966

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

codecov · 2025-11-13T14:37:30Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.12%. Comparing base (71a13a6) to head (19757e5).
⚠️ Report is 2 commits behind head on release-1.32.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-1.32    #9592   +/-   ##
=============================================
  Coverage         49.11%   49.12%           
=============================================
  Files               155      155           
  Lines             17562    17562           
=============================================
+ Hits               8626     8627    +1     
+ Misses             7861     7860    -1     
  Partials           1075     1075

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

bitoku · 2025-11-18T08:43:08Z

/lgtm

openshift-ci-robot · 2025-11-18T08:48:17Z

@saschagrunert: Jira Issue OCPBUGS-63772: All pull requests linked via external trackers have merged:

cri-o/cri-o#9592

Jira Issue OCPBUGS-63772 has been moved to the MODIFIED state.

Details

In response to this:

What type of PR is this?

/kind bug

What this PR does / why we need it:

Fixes CVE-2025-58183 by updating tar-split to v0.12.2.

CVE-2025-58183 is an unbounded allocation vulnerability in archive/tar when parsing GNU sparse map files. tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory.

tar-split v0.12.2 includes the fix that caps sparse block data to 1 MiB (same limit as PAX headers).

OpenShift Version: 4.19

Which issue(s) this PR fixes:

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2407258

Fixes: https://issues.redhat.com/browse/OCPBUGS-63772

Special notes for your reviewer:

This PR updates:

go.mod with tar-split v0.12.2

go.sum

Vendored dependencies (vendor/)

The vulnerability affects CRI-O's container image layer extraction code path through containers/storage which uses tar-split (a vendored fork of Go's archive/tar).

Does this PR introduce a user-facing change?
Fixed CVE-2025-58183: Updated tar-split to v0.12.2 to fix unbounded memory allocation vulnerability when parsing malicious container images with GNU sparse tar files.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

saschagrunert requested a review from mrunalp as a code owner November 13, 2025 11:37

openshift-ci bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/bug Categorizes issue or PR as related to a bug. dco-signoff: no Indicates the PR's author has not DCO signed all their commits. labels Nov 13, 2025

openshift-ci bot requested review from hasan4791 and klihub November 13, 2025 11:37

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 13, 2025

saschagrunert force-pushed the fix-cve-2025-58183-release-1.32 branch from cc065f1 to 19757e5 Compare November 13, 2025 11:40

openshift-ci bot added dco-signoff: yes Indicates the PR's author has DCO signed all their commits. and removed dco-signoff: no Indicates the PR's author has not DCO signed all their commits. labels Nov 13, 2025

saschagrunert changed the title ~~Fix CVE-2025-58183: Update tar-split to v0.12.2~~ [release-1.32] Fix CVE-2025-58183: Update tar-split to v0.12.2 Nov 13, 2025

saschagrunert changed the title ~~[release-1.32] Fix CVE-2025-58183: Update tar-split to v0.12.2~~ [release-1.32] OCPBUGS-63772: Fix CVE-2025-58183: Update tar-split to v0.12.2 Nov 13, 2025

saschagrunert changed the title ~~[release-1.32] OCPBUGS-63772: Fix CVE-2025-58183: Update tar-split to v0.12.2~~ [release-1.32] OCPBUGS-63771: Fix CVE-2025-58183: Update tar-split to v0.12.2 Nov 13, 2025

saschagrunert changed the title ~~[release-1.32] OCPBUGS-63771: Fix CVE-2025-58183: Update tar-split to v0.12.2~~ [release-1.32] OCPBUGS-63772: Fix CVE-2025-58183: Update tar-split to v0.12.2 Nov 13, 2025

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Nov 13, 2025

openshift-ci bot assigned bitoku Nov 18, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 18, 2025

openshift-merge-bot bot merged commit aadeb7d into cri-o:release-1.32 Nov 18, 2025
41 of 49 checks passed

saschagrunert deleted the fix-cve-2025-58183-release-1.32 branch November 18, 2025 08:51

[release-1.32] OCPBUGS-63772: Fix CVE-2025-58183: Update tar-split to v0.12.2 #9592

[release-1.32] OCPBUGS-63772: Fix CVE-2025-58183: Update tar-split to v0.12.2 #9592

Uh oh!

Conversation

saschagrunert commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci-robot commented Nov 13, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci bot commented Nov 13, 2025

Uh oh!

openshift-ci-robot commented Nov 13, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci-robot commented Nov 13, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

openshift-ci-robot commented Nov 13, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

saschagrunert commented Nov 13, 2025

Uh oh!

openshift-ci-robot commented Nov 13, 2025

Uh oh!

saschagrunert commented Nov 13, 2025

Uh oh!

openshift-ci-robot commented Nov 13, 2025

Uh oh!

openshift-ci bot commented Nov 13, 2025

Uh oh!

codecov bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bitoku commented Nov 18, 2025

Uh oh!

Uh oh!

openshift-ci-robot commented Nov 18, 2025

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

saschagrunert commented Nov 13, 2025 •

edited

Loading

codecov bot commented Nov 13, 2025 •

edited

Loading