CVE-2026-115207: Red Hat Enterprise Linux 10, обхождане на път

Описание

Оригинално описание

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.

Засегнати продукти

• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 6
• Red Hat Red Hat Enterprise Linux 7
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Hardened Images

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в Red Hat Red Hat Enterprise Linux 10

• 6.5CVE-2026-121259
• 6.5CVE-2026-119843
• 6.5CVE-2026-120831
• 7.4CVE-2026-120830
• 2.0CVE-2026-120740

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-115207
• https://nvd.nist.gov/vuln/detail/CVE-2026-115207
• https://access.redhat.com/security/cve/CVE-2026-115207
• https://bugzilla.redhat.com/show_bug.cgi?id=2558775
• http://www.openwall.com/lists/oss-security/2026/10/26/14