Multi Router Traffic Grapher
5c1a76a992
Backport fix for CVE-2026-72694 from Fedora rawhide. The patch addresses a symlink-following chown vulnerability (CWE-59) in mrtg's daemon mode pid file handling. When mrtg is started as root with --daemon --user, the pid file creation and chown operations could be exploited via symlinks. The fix makes create_pid() refuse symlinks, uses O_WRONLY|O_CREAT|O_EXCL for atomic file creation, and uses fchown on the open file handle instead of path-based chown. CVE: CVE-2026-72694 Upstream patches: - https://src.fedoraproject.org/rpms/mrtg/raw/rawhide/f/mrtg-2.17.10-CVE-2026-72694.patch Resolves: RHEL-236053 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir |
||
|---|---|---|
| .fmf | ||
| plans | ||
| tests | ||
| .gitignore | ||
| filter-provides-mrtg.sh | ||
| filter-requires-mrtg.sh | ||
| gating.yaml | ||
| mrtg-2.15.0-lib64.patch | ||
| mrtg-2.17.2-socket6-fix.patch | ||
| mrtg-2.17.4-cfgmaker-ifhighspeed.patch | ||
| mrtg-2.17.10-CVE-2026-72694.patch | ||
| mrtg-configure-c99.patch | ||
| mrtg-httpd.conf | ||
| mrtg.cfg | ||
| mrtg.crond.in | ||
| mrtg.fc | ||
| mrtg.if | ||
| mrtg.service | ||
| mrtg.spec | ||
| mrtg.te | ||
| mrtg.timer | ||
| mrtg.tmpfiles | ||
| sources | ||