Commit Graph

1 Commits

Author SHA1 Message Date
RHEL Packaging Agent
5cb1f83ea7 Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context
Add patch for CVE-2026-58015 which validates the cookie context
in the GDBus SHA-1 authentication mechanism. Without validation,
a malicious D-Bus server could send a crafted context containing
path traversal characters, allowing exfiltration of SHA-1 hashed
copies of arbitrary data from the client's file system. The patch
also includes an added `#include <stdint.h>` needed for the
`uint8_t` type used in the validation function on the older
glib2 2.68.4 codebase.

CVE: CVE-2026-58015
Upstream patches:
 - 8b72ad09c8.patch
Resolves: RHEL-212262

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-08-19 16:31:12 +00:00