Backport upstream commit 8b72ad09c874ddff to fix
CVE-2026-58015, a path traversal vulnerability in D-Bus
SHA-1 authentication. The patch adds validation of the
cookie context sent by the server, preventing exfiltration
of SHA-1 hashed copies of arbitrary files from the client's
filesystem. The upstream patch was adjusted to use guint8
instead of uint8_t for compatibility with the existing
GLib headers.
CVE: CVE-2026-58015
Upstream patches:
- 8b72ad09c8.patch
Resolves: RHEL-212242
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
