From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Vitezslav Crhonek To: git-commits@fedoraproject.org Subject: [rpms/mrtg] rawhide: Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling Date: Wed, 26 Aug 2026 06:09:11 GMT Message-ID: <178772455185.1.5460503370259305033.rpms-mrtg-1ec47da45b43@fedoraproject.org> List-ID: X-Git-Repo: rpms/mrtg X-Git-Branch: rawhide X-Git-Rev: 1ec47da45b438b1ddb7f784fa030a43fb2c2929d QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbXJ0ZwpCcmFuY2gg OiByYXdoaWRlCkNvbW1pdCA6IDFlYzQ3ZGE0NWI0MzhiMWRkYjdmNzg0ZmEwMzBhNDNmYjJjMjky OWQKQXV0aG9yIDogVml0ZXpzbGF2IENyaG9uZWsgPHZjcmhvbmVrQHJlZGhhdC5jb20+CkRhdGUg ICA6IDIwMjYtMDgtMjZUMDg6MDg6MjgrMDI6MDAKU3RhdHMgIDogKzEyMS8tMSBpbiAyIGZpbGUo cykKVVJMICAgIDogaHR0cHM6Ly9zcmMuZmVkb3JhcHJvamVjdC5vcmcvcnBtcy9tcnRnL2MvMWVj NDdkYTQ1YjQzOGIxZGRiN2Y3ODRmYTAzMGE0M2ZiMmMyOTI5ZD9icmFuY2g9cmF3aGlkZQoKTG9n OgpGaXggQ1ZFLTIwMjYtNzI2OTQ6IHN5bWxpbmstZm9sbG93aW5nIHByaXZpbGVnZSBlc2NhbGF0 aW9uIGluIFBJRCBmaWxlIGhhbmRsaW5nCgotLS0KZGlmZiAtLWdpdCBhL21ydGctMi4xNy4xMC1D VkUtMjAyNi03MjY5NC5wYXRjaCBiL21ydGctMi4xNy4xMC1DVkUtMjAyNi03MjY5NC5wYXRjaApu ZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi5jOTVhMzJjCi0tLSAvZGV2L251bGwK KysrIGIvbXJ0Zy0yLjE3LjEwLUNWRS0yMDI2LTcyNjk0LnBhdGNoCkBAIC0wLDAgKzEsMTEzIEBA CitGcm9tIDM0Nzk4MjZiN2Q0YTMwYjIxY2NkNzk2ZmNlYzA5MzEyM2U5N2IyNWUgTW9uIFNlcCAx NyAwMDowMDowMCAyMDAxCitGcm9tOiBUb2JpYXMgT2V0aWtlciA8dG9iaUBvZXRpa2VyLmNoPgor RGF0ZTogVHVlLCAzMCBKdW4gMjAyNiAyMzozNDo0MCArMDIwMAorU3ViamVjdDogW1BBVENIXSBG aXggc3ltbGluay1mb2xsb3dpbmcgY2hvd24gb2YgcGlkIGZpbGUgaW4gZGFlbW9uIG1vZGUKKyAo Q1dFLTU5KSAoIzEyMykKKworV2hlbiBtcnRnIGlzIHN0YXJ0ZWQgYXMgcm9vdCBpbiBkYWVtb24g bW9kZSAoLS1kYWVtb24gLS11c2VyKSwgaXQKK2NyZWF0ZWQgdGhlIHBpZCBmaWxlIGFuZCBjaG93 bidlZCBpdCB0byB0aGUgdGFyZ2V0IHVzZXIgKmJlZm9yZSoKK2Ryb3BwaW5nIHByaXZpbGVnZXMu IEJvdGggY3JlYXRlX3BpZCgpJ3MgYC1lYC9gb3BlbigiPi4uLiIpYCBhbmQgdGhlCitzdWJzZXF1 ZW50IGBjaG93bmAgZm9sbG93IHN5bWxpbmtzLCBzbyBhIGxvY2FsIGF0dGFja2VyIHdobyBjYW4K K3ByZS1wbGFjZSBhIHN5bWxpbmsgYXQgdGhlIHBpZCBwYXRoIChlLmcuIGEgcGlkIGZpbGUgaW4g YSB3cml0YWJsZQorZGlyZWN0b3J5KSBjb3VsZCBtYWtlIHJvb3QgY2hvd24gYW4gYXJiaXRyYXJ5 IGV4aXN0aW5nIGZpbGUgdG8gdGhlCitkYWVtb24gdXNlciwgb3IgY3JlYXRlIGEgcm9vdC1vd25l ZCBmaWxlIGF0IGFuIGF0dGFja2VyLWNob3NlbiBwYXRoLgorCitSYXRoZXIgdGhhbiByZW9yZGVy IHRoZSBwcml2aWxlZ2UgZHJvcCAod2hpY2ggd291bGQgYnJlYWsgdGhlIGNvbW1vbgorY2FzZSBv ZiBhIHJvb3Qtb3duZWQgcGlkIGRpcmVjdG9yeSwgd2hlcmUgdGhlIHVucHJpdmlsZWdlZCBkYWVt b24KK2Nhbm5vdCBjcmVhdGUgdGhlIGZpbGUgaXRzZWxmKSwga2VlcCBjcmVhdGluZyB0aGUgZmls ZSB3aGlsZQorcHJpdmlsZWdlZCBidXQgZG8gaXQgc2FmZWx5OgorCistIGNyZWF0ZV9waWQoKSBy ZWZ1c2VzIHN5bWxpbmtzIGFuZCBjcmVhdGVzIHRoZSBmaWxlIHdpdGgKKyAgT19XUk9OTFl8T19D UkVBVHxPX0VYQ0wsIGNsb3NpbmcgdGhlIHN5bWxpbmstZm9sbG93IC8gVE9DVE9VIHdpbmRvdy4K Ky0gSXQgY2hvd25zIHRoZSBvcGVuIGZpbGVoYW5kbGUgKGZjaG93bikgaW5zdGVhZCBvZiB0aGUg cGF0aCwgc28gdGhlCisgIG93bmVyc2hpcCBjaGFuZ2UgY2Fubm90IGJlIHJlZGlyZWN0ZWQgdGhy b3VnaCBhIHN3YXBwZWQtaW4gc3ltbGluay4KKyAgVGhlIGNhbGxlciBubyBsb25nZXIgZG9lcyBh IHNlcGFyYXRlIHBhdGgtYmFzZWQgY2hvd24uCistIGRlbW9uaXplX21lKCkncyBsYXRlciBwaWQg d3JpdGUgcmVmdXNlcyBzeW1saW5rcyB0b28uCisKK1JlcG9ydGVkIGJ5IEFpc2xlIFJlc2VhcmNo IHZpYSBWaXRlenNsYXYgQ3Job25lay4KKworQ28tYXV0aG9yZWQtYnk6IENsYXVkZSBPcHVzIDQu OCA8bm9yZXBseUBhbnRocm9waWMuY29tPgorLS0tCisgYmluL21ydGcgICAgICAgICAgICAgIHwg IDggKysrKystLS0KKyBsaWIvbXJ0ZzIvTVJUR19saWIucG0gfCAzMiArKysrKysrKysrKysrKysr KysrKysrKysrKy0tLS0tLQorIDIgZmlsZXMgY2hhbmdlZCwgMzEgaW5zZXJ0aW9ucygrKSwgOSBk ZWxldGlvbnMoLSkKKworZGlmZiAtLWdpdCBhL2Jpbi9tcnRnIGIvYmluL21ydGcKK2luZGV4IGJh NTIwY2EuLjNhNGVmZTUgMTAwNzU1CistLS0gYS9iaW4vbXJ0ZworKysrIGIvYmluL21ydGcKK0BA IC0yNTIsOSArMjUyLDExIEBAIHN1YiBtYWluIHsKKyAKKyAgICAgIyBSdW4gYXMgYSBkYWVtb24s IHNwZWNpZmllZCBvbiBjb21tYW5kIGxpbmUgKHJlcXVpcmVkIGZvciBGSFMgY29tcGxpYW50IGRh ZW1vbikKKyAgICAgaWYgKGRlZmluZWQgJG9wdHN7ImRhZW1vbiJ9KSB7CistCSMgQ3JlYXRlIGEg cGlkZmlsZSwgdGhlbiBjaG93biBpdCBzbyB3ZSBjYW4gdXNlIGl0IG9uY2Ugd2UgY2hhbmdlIHVz ZXIKKy0JJmNyZWF0ZV9waWQoJHBpZGZpbGUpOworLQljaG93biAkdWlkLCAkZ2lkLCAkcGlkZmls ZTsKKysJIyBDcmVhdGUgdGhlIHBpZGZpbGUgc2VjdXJlbHkgYW5kLCB3aGlsZSBzdGlsbCBwcml2 aWxlZ2VkLCBoYW5kIGl0IHRvCisrCSMgdGhlIHVzZXIgd2UgYXJlIGFib3V0IHRvIGJlY29tZSBz byB0aGUgZGFlbW9uIGNhbiB1cGRhdGUgaXQgbGF0ZXIuCisrCSMgY3JlYXRlX3BpZCByZWZ1c2Vz IHN5bWxpbmtzIGFuZCBjaG93bnMgdGhlIG9wZW4gaGFuZGxlIChub3QgdGhlIHBhdGgpLAorKwkj IHNvIGEgaG9zdGlsZSBwaWQgcGF0aCBjYW5ub3QgYmUgdXNlZCB0byBjaG93biBhbiBhcmJpdHJh cnkgZmlsZS4KKysJJmNyZWF0ZV9waWQoJHBpZGZpbGUsICR1aWQsICRnaWQpOworICAgICB9Cisg CisgICAgICgkKCwkKSkgPSAoJGdpZCwkZ2lkKSA7CitkaWZmIC0tZ2l0IGEvbGliL21ydGcyL01S VEdfbGliLnBtIGIvbGliL21ydGcyL01SVEdfbGliLnBtCitpbmRleCAxYzEyZjZjLi42MzU5YjAx IDEwMDY0NAorLS0tIGEvbGliL21ydGcyL01SVEdfbGliLnBtCisrKysgYi9saWIvbXJ0ZzIvTVJU R19saWIucG0KK0BAIC0xNiw2ICsxNiw3IEBAIHBhY2thZ2UgTVJUR19saWI7CisgCisgcmVxdWly ZSA1LjAwNTsKKyB1c2Ugc3RyaWN0OworK3VzZSBGY250bCBxdyhPX1dST05MWSBPX0NSRUFUIE9f RVhDTCk7CisgdXNlIHZhcnMgcXcoJE9TICRTTCAkUFMgQEVYUE9SVCBASVNBICRWRVJTSU9OICV0 aW1lc3RycG9zcGF0dGVybik7CisgCisgCitAQCAtMTIzMywxNCArMTIzNCwzMSBAQCBzdWIgZXhw aXN0ciAoJCkgeworICAgICByZXR1cm4gIiR3ZGF5LCAkbWRheSAkbW9udGggIi4oJHllYXIrMTkw MCkuIiAkaG91cjokbWluOiRzZWMgR01UIjsKKyB9CisgCistc3ViIGNyZWF0ZV9waWQgKCQpIHsK Ky0gICAgbXkgJHBpZGZpbGUgPSBzaGlmdDsKKytzdWIgY3JlYXRlX3BpZCAoJDskJCkgeworKyAg ICBteSAoJHBpZGZpbGUsICR1aWQsICRnaWQpID0gQF87CisgICAgIHJldHVybiBpZiAoJE9TIGVx ICdOVCcgKTsKKysKKysgICAgIyBTZWN1cml0eTogcmVmdXNlIHRvIG9wZXJhdGUgb24gYSBzeW1s aW5rLiBXaGVuIG1ydGcgaXMgc3RhcnRlZCBhcyByb290CisrICAgICMgaW4gZGFlbW9uIG1vZGUg d2l0aCBhIHdyaXRhYmxlIHBpZCBwYXRoLCBhbiBhdHRhY2tlciB3aG8gcHJlLXBsYWNlcyBhCisr ICAgICMgc3ltbGluayBoZXJlIGNvdWxkIG90aGVyd2lzZSBtYWtlIHVzIGNyZWF0ZSBvciBjaG93 biBhbiBhcmJpdHJhcnkgZmlsZQorKyAgICAjIChDV0UtNTkpLiBBIHBsYWluIHN0YXQvLWUgb24g dGhlIHBhdGggd291bGQgZm9sbG93IHRoZSBsaW5rLCBzbyBjaGVjaworKyAgICAjIHRoZSBsaW5r IGl0c2VsZiBmaXJzdC4KKysgICAgaWYgKC1sICRwaWRmaWxlKSB7CisrICAgICAgICB3YXJuICJy ZWZ1c2luZyB0byB1c2UgcGlkIGZpbGUgJHBpZGZpbGU6IGl0IGlzIGEgc3ltYm9saWMgbGlua1xu IjsKKysgICAgICAgIHJldHVybjsKKysgICAgfQorICAgICByZXR1cm4gaWYgLWUgJHBpZGZpbGU7 CistICAgIGlmICggb3BlbihQSURGSUxFLCI+JHBpZGZpbGUiKSkgeworLSAgICAgICAgIGNsb3Nl IFBJREZJTEU7CisrCisrICAgICMgT19DUkVBVHxPX0VYQ0wgY3JlYXRlcyB0aGUgZmlsZSBhdG9t aWNhbGx5IGFuZCBmYWlscyBpZiBhbnl0aGluZworKyAgICAjIChpbmNsdWRpbmcgYSBzeW1saW5r IHRoYXQgd2FzIHJhY2VkIGluIGFmdGVyIHRoZSBjaGVjayBhYm92ZSkgYWxyZWFkeQorKyAgICAj IGV4aXN0cyBhdCB0aGUgcGF0aCwgY2xvc2luZyB0aGUgc3ltbGluay1mb2xsb3cgLyBUT0NUT1Ug d2luZG93LgorKyAgICBpZiAoIHN5c29wZW4obXkgJGZoLCAkcGlkZmlsZSwgT19XUk9OTFl8T19D UkVBVHxPX0VYQ0wsIDA2NDQpICkgeworKyAgICAgICAgICMgY2hvd24gdGhlIG9wZW4gaGFuZGxl IChmY2hvd24pIHJhdGhlciB0aGFuIHRoZSBwYXRoLCBzbyB0aGUKKysgICAgICAgICAjIG93bmVy c2hpcCBjaGFuZ2UgY2Fubm90IGJlIHJlZGlyZWN0ZWQgdGhyb3VnaCBhIHN3YXBwZWQtaW4gc3lt bGluay4KKysgICAgICAgICBjaG93biAkdWlkLCAkZ2lkLCAkZmggaWYgZGVmaW5lZCAkdWlkIGFu ZCBkZWZpbmVkICRnaWQ7CisrICAgICAgICAgY2xvc2UgJGZoOworICAgICB9IGVsc2UgeworLSAg ICAgICAgIHdhcm4gImNhbm5vdCB3cml0ZSB0byAkcGlkZmlsZTogJCFcbiI7CisrICAgICAgICAg d2FybiAiY2Fubm90IGNyZWF0ZSBwaWQgZmlsZSAkcGlkZmlsZTogJCFcbiI7CisgICAgIH0KKyB9 CisgCitAQCAtMTI4Niw3ICsxMzA0LDkgQEAgc3ViIGRlbW9uaXplX21lICgkKSB7CisgICAgICAg ICAgICAgfSBlbHNlIHsKKyAgICAgICAgICAgICAgICAgaWYgKGRlZmluZWQgJHBpZGZpbGUpewor ICAgICAgICAgICAgICAgICAgICAkbWFpbjo6Q2xlYW5maWxlMyA9ICRwaWRmaWxlOworLSAgICAg ICAgICAgICAgICAgICBpZiAob3BlbihQSURGSUxFLCI+JHBpZGZpbGUiKSkgeworKyAgICAgICAg ICAgICAgICAgICBpZiAoLWwgJHBpZGZpbGUpIHsKKysgICAgICAgICAgICAgICAgICAgICAgICB3 YXJuICJyZWZ1c2luZyB0byB3cml0ZSBwaWQgZmlsZSAkcGlkZmlsZTogaXQgaXMgYSBzeW1ib2xp YyBsaW5rXG4iOworKyAgICAgICAgICAgICAgICAgICB9IGVsc2lmIChvcGVuKFBJREZJTEUsIj4k cGlkZmlsZSIpKSB7CisgICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQgUElERklMRSAiJCRc biI7CisgICAgICAgICAgICAgICAgICAgICAgICAgY2xvc2UgUElERklMRTsKKyAgICAgICAgICAg ICAgICAgICAgfSBlbHNlIHsKCmRpZmYgLS1naXQgYS9tcnRnLnNwZWMgYi9tcnRnLnNwZWMKaW5k ZXggMGJmMDlmOS4uNDUxZjc1ZSAxMDA2NDQKLS0tIGEvbXJ0Zy5zcGVjCisrKyBiL21ydGcuc3Bl YwpAQCAtMTEsNyArMTEsNyBAQAogU3VtbWFyeTogICBNdWx0aSBSb3V0ZXIgVHJhZmZpYyBHcmFw aGVyCiBOYW1lOiAgICAgIG1ydGcKIFZlcnNpb246ICAgMi4xNy4xMAotUmVsZWFzZTogICAxNCV7 P2Rpc3R9CitSZWxlYXNlOiAgIDE1JXs/ZGlzdH0KIFVSTDogICAgICAgaHR0cDovL29zcy5vZXRp a2VyLmNoL21ydGcvCiBTb3VyY2UwOiAgIGh0dHA6Ly9vc3Mub2V0aWtlci5jaC9tcnRnL3B1Yi9t cnRnLSV7dmVyc2lvbn0udGFyLmd6CiBTb3VyY2UxOiAgIGh0dHA6Ly9vc3Mub2V0aWtlci5jaC9t cnRnL3B1Yi9tcnRnLSV7dmVyc2lvbn0udGFyLmd6Lm1kNQpAQCAtMzksNiArMzksOCBAQCBQYXRj aDE6ICAgIG1ydGctMi4xNy4yLXNvY2tldDYtZml4LnBhdGNoCiAjIFBhdGNoMjogc29tZSBkZXZp Y2VzIHJldHVybiAyKiozMi0yIG9uIGlmU3BlZWQgKGUuIGcuIElCTSBGaWJyZUNoYW5uZWwgc3dp dGNoZXMpCiBQYXRjaDI6ICAgIG1ydGctMi4xNy40LWNmZ21ha2VyLWlmaGlnaHNwZWVkLnBhdGNo CiBQYXRjaDM6ICAgIG1ydGctY29uZmlndXJlLWM5OS5wYXRjaAorIyBQYXRjaDQ6IGZpeGVzIENW RS0yMDI2LTcyNjk0LCBiYWNrcG9ydGVkIGZyb20gdXBzdHJlYW0KK1BhdGNoNDogICAgbXJ0Zy0y LjE3LjEwLUNWRS0yMDI2LTcyNjk0LnBhdGNoCiBMaWNlbnNlOiAgIEdQTC0yLjAtb3ItbGF0ZXIK IFJlcXVpcmVzKHBvc3QpOiBzeXN0ZW1kLXVuaXRzCiBSZXF1aXJlcyhwcmV1bik6IHN5c3RlbWQt dW5pdHMKQEAgLTg0LDYgKzg2LDcgQEAgQ3VzdG9tIFNFTGludXggcG9saWN5IG1vZHVsZQogJXBh dGNoIC1QMSAtcDEgLWIgLnNvY2tldDYKICVwYXRjaCAtUDIgLXAxIC1iIC5pZmhpZ2hzcGVlZAog JXBhdGNoIC1QMyAtcDEgLWIgLmM5OQorJXBhdGNoIC1QNCAtcDEgLWIgLkNWRS0yMDI2LTcyNjk0 CiAKIGZvciBpIGluIGRvYy9tcnRnLWZvcnVtLjEgZG9jL21ydGctc3F1aWQuMSBDSEFOR0VTOyBk bwogICAgIGljb252IC1mIGlzby04ODU5LTEgLXQgdXRmLTggPCAiJGkiID4gIiR7aX1fIgpAQCAt MjEyLDYgKzIxNSwxMCBAQCBmaQogJWVuZGlmCiAKICVjaGFuZ2Vsb2cKKyogV2VkIEF1ZyAyNiAy MDI2IFZpdGV6c2xhdiBDcmhvbmVrIDx2Y3Job25la0ByZWRoYXQuY29tPiAtIDIuMTcuMTAtMTUK Ky0gRml4IENWRS0yMDI2LTcyNjk0OiBzeW1saW5rLWZvbGxvd2luZyBwcml2aWxlZ2UgZXNjYWxh dGlvbiBpbiBQSUQgZmlsZSBoYW5kbGluZworICBSZXNvbHZlczogIzI1MTM4MjkKKwogKiBUaHUg SnVsIDE2IDIwMjYgRmVkb3JhIFJlbGVhc2UgRW5naW5lZXJpbmcgPHJlbGVuZ0BmZWRvcmFwcm9q ZWN0Lm9yZz4gLSAyLjE3LjEwLTE0CiAtIFJlYnVpbHQgZm9yIGh0dHBzOi8vZmVkb3JhcHJvamVj dC5vcmcvd2lraS9GZWRvcmFfNDVfTWFzc19SZWJ1aWxkCiAK