rpms/pcp
7
0
Fork 0
Code Issues Pull Requests Releases Activity
System-level performance monitoring and performance management
395 Commits 10 Branches 82 Tags 4.2 MiB
Diff 100%
3168b52f62
Go to file
RHEL Packaging Agent 3168b52f62 Fix CVE-2026-16531: path traversal via hostname in pmproxy 
Backport upstream commit dd6ed05f to fix a path traversal
vulnerability (CVE-2026-16531, CWE-22) in the pmproxy logger
servlet. The hostname field from a __pmLogLabel PDU was used
directly in path construction without sanitization, allowing
creation of files at arbitrary paths. The fix adds a
check_hostname() function that validates hostnames against an
allowlist of alphanumeric characters, hyphens, dots, and
underscores (per RFC 952/1123), rejecting invalid hostnames
with -EINVAL before any path construction occurs.

CVE: CVE-2026-16531
Upstream patches:
 - dd6ed05f14.patch
Resolves: RHEL-213756

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-07-30 12:41:07 +00:00
.fmf Initial implementation of Fedora gating for PCP 2021-02-08 08:20:06 +01:00
.gitignore Update to latest community sources (PCP v6) 2022-08-31 15:36:47 +10:00
ci.fmf Fix of ci.fmf 2025-09-30 14:58:32 +02:00
gating.yaml Reconfigured gating 2025-09-24 08:59:03 +02:00
pcp-7.1.5-CVE-2026-16530.patch Fix CVE-2026-16530: arbitrary pointer deref in __pmLogLoadInDom 2026-07-30 12:37:26 +00:00
pcp-7.1.5-CVE-2026-16531.patch Fix CVE-2026-16531: path traversal via hostname in pmproxy 2026-07-30 12:41:07 +00:00
pcp.spec Fix CVE-2026-16531: path traversal via hostname in pmproxy 2026-07-30 12:41:07 +00:00
rpminspect.yaml Rebase to pcp-7.1.5 2026-06-08 09:49:59 -04:00
sources Rebase to pcp-7.1.5 2026-06-08 09:49:59 -04:00