Add a backport of upstream commit 8b72ad09 which fixes
CVE-2026-58015 by validating D-Bus cookie context names
in gdbusauthmechanismsha1. The new validate_cookie_context()
function rejects contexts containing non-ASCII characters or
path traversal characters (/, \, .) before they can be used
for file path construction.
The patch was adapted for the older GLib 2.56.4 codebase:
uint8_t cast replaced with guint8, and reject_reason usage
replaced with g_warning() to avoid pulling in a separate
upstream prerequisite commit.
CVE: CVE-2026-58015
Upstream patches:
- 8b72ad09c8.patch
Resolves: RHEL-212254
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
