rpms/mrtg
7
0
Fork 0
Code Issues Pull Requests Releases Activity
Multi Router Traffic Grapher
5 Commits 8 Branches 14 Tags 248 KiB
Shell 100%
8a5699ed82
Go to file
RHEL Packaging Agent 8a5699ed82 Fix CVE-2026-72694: symlink-following chown of pid file in daemon mode 
Backport upstream commit 30e19216bf to fix CVE-2026-72694
(CWE-59), a symlink-following chown vulnerability in MRTG's
PID file handling during daemon mode startup.

The fix ensures create_pid() refuses symlinks, creates the
PID file atomically with O_WRONLY|O_CREAT|O_EXCL, and uses
fchown on the open filehandle instead of path-based chown,
preventing a local attacker from redirecting ownership
changes to arbitrary files via a pre-placed symlink.

CVE: CVE-2026-72694
Upstream patches:
 - 30e19216bf.patch
Resolves: RHEL-236037

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-08-11 09:16:14 +00:00
.gitignore re-import sources as agreed with the maintainer 2023-07-24 14:02:33 +02:00
filter-provides-mrtg.sh Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
filter-requires-mrtg.sh Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
mrtg-2.15.0-lib64.patch Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
mrtg-2.17.2-socket6-fix.patch Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
mrtg-2.17.4-cfgmaker-ifhighspeed.patch Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
mrtg-2.17.7-CVE-2026-72694.patch Fix CVE-2026-72694: symlink-following chown of pid file in daemon mode 2026-08-11 09:16:14 +00:00
mrtg-httpd.conf Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
mrtg.cfg Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
mrtg.crond.in re-import sources as agreed with the maintainer 2023-07-24 14:02:33 +02:00
mrtg.service Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
mrtg.spec Fix CVE-2026-72694: symlink-following chown of pid file in daemon mode 2026-08-11 09:16:14 +00:00
mrtg.timer Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
mrtg.tmpfiles Auto sync2gitlab import of mrtg-2.17.7-1.el8.src.rpm 2022-05-26 11:49:06 -04:00
sources re-import sources as agreed with the maintainer 2023-07-24 14:02:33 +02:00