From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Vitezslav Crhonek To: git-commits@fedoraproject.org Subject: [rpms/mrtg] f45: Fix CVE-2026-72694: symlink-following privilege escalation in PID file handling Date: Wed, 26 Aug 2026 07:36:17 GMT Message-ID: <178772977787.1.13587878209012931916.rpms-mrtg-e6ee31703c00@fedoraproject.org> List-ID: X-Git-Repo: rpms/mrtg X-Git-Branch: f45 X-Git-Rev: e6ee31703c0097e1e4339c1f8567dfe87aaaaa5e QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvbXJ0ZwpCcmFuY2gg OiBmNDUKQ29tbWl0IDogZTZlZTMxNzAzYzAwOTdlMWU0MzM5YzFmODU2N2RmZTg3YWFhYWE1ZQpB dXRob3IgOiBWaXRlenNsYXYgQ3Job25layA8dmNyaG9uZWtAcmVkaGF0LmNvbT4KRGF0ZSAgIDog MjAyNi0wOC0yNlQwOTozMzo0MyswMjowMApTdGF0cyAgOiArMTIxLy0xIGluIDIgZmlsZShzKQpV UkwgICAgOiBodHRwczovL3NyYy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL21ydGcvYy9lNmVlMzE3 MDNjMDA5N2UxZTQzMzljMWY4NTY3ZGZlODdhYWFhYTVlP2JyYW5jaD1mNDUKCkxvZzoKRml4IENW RS0yMDI2LTcyNjk0OiBzeW1saW5rLWZvbGxvd2luZyBwcml2aWxlZ2UgZXNjYWxhdGlvbiBpbiBQ SUQgZmlsZSBoYW5kbGluZwoKLS0tCmRpZmYgLS1naXQgYS9tcnRnLTIuMTcuMTAtQ1ZFLTIwMjYt NzI2OTQucGF0Y2ggYi9tcnRnLTIuMTcuMTAtQ1ZFLTIwMjYtNzI2OTQucGF0Y2gKbmV3IGZpbGUg bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uYzk1YTMyYwotLS0gL2Rldi9udWxsCisrKyBiL21y dGctMi4xNy4xMC1DVkUtMjAyNi03MjY5NC5wYXRjaApAQCAtMCwwICsxLDExMyBAQAorRnJvbSAz NDc5ODI2YjdkNGEzMGIyMWNjZDc5NmZjZWMwOTMxMjNlOTdiMjVlIE1vbiBTZXAgMTcgMDA6MDA6 MDAgMjAwMQorRnJvbTogVG9iaWFzIE9ldGlrZXIgPHRvYmlAb2V0aWtlci5jaD4KK0RhdGU6IFR1 ZSwgMzAgSnVuIDIwMjYgMjM6MzQ6NDAgKzAyMDAKK1N1YmplY3Q6IFtQQVRDSF0gRml4IHN5bWxp bmstZm9sbG93aW5nIGNob3duIG9mIHBpZCBmaWxlIGluIGRhZW1vbiBtb2RlCisgKENXRS01OSkg KCMxMjMpCisKK1doZW4gbXJ0ZyBpcyBzdGFydGVkIGFzIHJvb3QgaW4gZGFlbW9uIG1vZGUgKC0t ZGFlbW9uIC0tdXNlciksIGl0CitjcmVhdGVkIHRoZSBwaWQgZmlsZSBhbmQgY2hvd24nZWQgaXQg dG8gdGhlIHRhcmdldCB1c2VyICpiZWZvcmUqCitkcm9wcGluZyBwcml2aWxlZ2VzLiBCb3RoIGNy ZWF0ZV9waWQoKSdzIGAtZWAvYG9wZW4oIj4uLi4iKWAgYW5kIHRoZQorc3Vic2VxdWVudCBgY2hv d25gIGZvbGxvdyBzeW1saW5rcywgc28gYSBsb2NhbCBhdHRhY2tlciB3aG8gY2FuCitwcmUtcGxh Y2UgYSBzeW1saW5rIGF0IHRoZSBwaWQgcGF0aCAoZS5nLiBhIHBpZCBmaWxlIGluIGEgd3JpdGFi bGUKK2RpcmVjdG9yeSkgY291bGQgbWFrZSByb290IGNob3duIGFuIGFyYml0cmFyeSBleGlzdGlu ZyBmaWxlIHRvIHRoZQorZGFlbW9uIHVzZXIsIG9yIGNyZWF0ZSBhIHJvb3Qtb3duZWQgZmlsZSBh dCBhbiBhdHRhY2tlci1jaG9zZW4gcGF0aC4KKworUmF0aGVyIHRoYW4gcmVvcmRlciB0aGUgcHJp dmlsZWdlIGRyb3AgKHdoaWNoIHdvdWxkIGJyZWFrIHRoZSBjb21tb24KK2Nhc2Ugb2YgYSByb290 LW93bmVkIHBpZCBkaXJlY3RvcnksIHdoZXJlIHRoZSB1bnByaXZpbGVnZWQgZGFlbW9uCitjYW5u b3QgY3JlYXRlIHRoZSBmaWxlIGl0c2VsZiksIGtlZXAgY3JlYXRpbmcgdGhlIGZpbGUgd2hpbGUK K3ByaXZpbGVnZWQgYnV0IGRvIGl0IHNhZmVseToKKworLSBjcmVhdGVfcGlkKCkgcmVmdXNlcyBz eW1saW5rcyBhbmQgY3JlYXRlcyB0aGUgZmlsZSB3aXRoCisgIE9fV1JPTkxZfE9fQ1JFQVR8T19F WENMLCBjbG9zaW5nIHRoZSBzeW1saW5rLWZvbGxvdyAvIFRPQ1RPVSB3aW5kb3cuCistIEl0IGNo b3ducyB0aGUgb3BlbiBmaWxlaGFuZGxlIChmY2hvd24pIGluc3RlYWQgb2YgdGhlIHBhdGgsIHNv IHRoZQorICBvd25lcnNoaXAgY2hhbmdlIGNhbm5vdCBiZSByZWRpcmVjdGVkIHRocm91Z2ggYSBz d2FwcGVkLWluIHN5bWxpbmsuCisgIFRoZSBjYWxsZXIgbm8gbG9uZ2VyIGRvZXMgYSBzZXBhcmF0 ZSBwYXRoLWJhc2VkIGNob3duLgorLSBkZW1vbml6ZV9tZSgpJ3MgbGF0ZXIgcGlkIHdyaXRlIHJl ZnVzZXMgc3ltbGlua3MgdG9vLgorCitSZXBvcnRlZCBieSBBaXNsZSBSZXNlYXJjaCB2aWEgVml0 ZXpzbGF2IENyaG9uZWsuCisKK0NvLWF1dGhvcmVkLWJ5OiBDbGF1ZGUgT3B1cyA0LjggPG5vcmVw bHlAYW50aHJvcGljLmNvbT4KKy0tLQorIGJpbi9tcnRnICAgICAgICAgICAgICB8ICA4ICsrKysr LS0tCisgbGliL21ydGcyL01SVEdfbGliLnBtIHwgMzIgKysrKysrKysrKysrKysrKysrKysrKysr KystLS0tLS0KKyAyIGZpbGVzIGNoYW5nZWQsIDMxIGluc2VydGlvbnMoKyksIDkgZGVsZXRpb25z KC0pCisKK2RpZmYgLS1naXQgYS9iaW4vbXJ0ZyBiL2Jpbi9tcnRnCitpbmRleCBiYTUyMGNhLi4z YTRlZmU1IDEwMDc1NQorLS0tIGEvYmluL21ydGcKKysrKyBiL2Jpbi9tcnRnCitAQCAtMjUyLDkg KzI1MiwxMSBAQCBzdWIgbWFpbiB7CisgCisgICAgICMgUnVuIGFzIGEgZGFlbW9uLCBzcGVjaWZp ZWQgb24gY29tbWFuZCBsaW5lIChyZXF1aXJlZCBmb3IgRkhTIGNvbXBsaWFudCBkYWVtb24pCisg ICAgIGlmIChkZWZpbmVkICRvcHRzeyJkYWVtb24ifSkgeworLQkjIENyZWF0ZSBhIHBpZGZpbGUs IHRoZW4gY2hvd24gaXQgc28gd2UgY2FuIHVzZSBpdCBvbmNlIHdlIGNoYW5nZSB1c2VyCistCSZj cmVhdGVfcGlkKCRwaWRmaWxlKTsKKy0JY2hvd24gJHVpZCwgJGdpZCwgJHBpZGZpbGU7CisrCSMg Q3JlYXRlIHRoZSBwaWRmaWxlIHNlY3VyZWx5IGFuZCwgd2hpbGUgc3RpbGwgcHJpdmlsZWdlZCwg aGFuZCBpdCB0bworKwkjIHRoZSB1c2VyIHdlIGFyZSBhYm91dCB0byBiZWNvbWUgc28gdGhlIGRh ZW1vbiBjYW4gdXBkYXRlIGl0IGxhdGVyLgorKwkjIGNyZWF0ZV9waWQgcmVmdXNlcyBzeW1saW5r cyBhbmQgY2hvd25zIHRoZSBvcGVuIGhhbmRsZSAobm90IHRoZSBwYXRoKSwKKysJIyBzbyBhIGhv c3RpbGUgcGlkIHBhdGggY2Fubm90IGJlIHVzZWQgdG8gY2hvd24gYW4gYXJiaXRyYXJ5IGZpbGUu CisrCSZjcmVhdGVfcGlkKCRwaWRmaWxlLCAkdWlkLCAkZ2lkKTsKKyAgICAgfQorIAorICAgICAo JCgsJCkpID0gKCRnaWQsJGdpZCkgOworZGlmZiAtLWdpdCBhL2xpYi9tcnRnMi9NUlRHX2xpYi5w bSBiL2xpYi9tcnRnMi9NUlRHX2xpYi5wbQoraW5kZXggMWMxMmY2Yy4uNjM1OWIwMSAxMDA2NDQK Ky0tLSBhL2xpYi9tcnRnMi9NUlRHX2xpYi5wbQorKysrIGIvbGliL21ydGcyL01SVEdfbGliLnBt CitAQCAtMTYsNiArMTYsNyBAQCBwYWNrYWdlIE1SVEdfbGliOworIAorIHJlcXVpcmUgNS4wMDU7 CisgdXNlIHN0cmljdDsKKyt1c2UgRmNudGwgcXcoT19XUk9OTFkgT19DUkVBVCBPX0VYQ0wpOwor IHVzZSB2YXJzIHF3KCRPUyAkU0wgJFBTIEBFWFBPUlQgQElTQSAkVkVSU0lPTiAldGltZXN0cnBv c3BhdHRlcm4pOworIAorIAorQEAgLTEyMzMsMTQgKzEyMzQsMzEgQEAgc3ViIGV4cGlzdHIgKCQp IHsKKyAgICAgcmV0dXJuICIkd2RheSwgJG1kYXkgJG1vbnRoICIuKCR5ZWFyKzE5MDApLiIgJGhv dXI6JG1pbjokc2VjIEdNVCI7CisgfQorIAorLXN1YiBjcmVhdGVfcGlkICgkKSB7CistICAgIG15 ICRwaWRmaWxlID0gc2hpZnQ7Cisrc3ViIGNyZWF0ZV9waWQgKCQ7JCQpIHsKKysgICAgbXkgKCRw aWRmaWxlLCAkdWlkLCAkZ2lkKSA9IEBfOworICAgICByZXR1cm4gaWYgKCRPUyBlcSAnTlQnICk7 CisrCisrICAgICMgU2VjdXJpdHk6IHJlZnVzZSB0byBvcGVyYXRlIG9uIGEgc3ltbGluay4gV2hl biBtcnRnIGlzIHN0YXJ0ZWQgYXMgcm9vdAorKyAgICAjIGluIGRhZW1vbiBtb2RlIHdpdGggYSB3 cml0YWJsZSBwaWQgcGF0aCwgYW4gYXR0YWNrZXIgd2hvIHByZS1wbGFjZXMgYQorKyAgICAjIHN5 bWxpbmsgaGVyZSBjb3VsZCBvdGhlcndpc2UgbWFrZSB1cyBjcmVhdGUgb3IgY2hvd24gYW4gYXJi aXRyYXJ5IGZpbGUKKysgICAgIyAoQ1dFLTU5KS4gQSBwbGFpbiBzdGF0Ly1lIG9uIHRoZSBwYXRo IHdvdWxkIGZvbGxvdyB0aGUgbGluaywgc28gY2hlY2sKKysgICAgIyB0aGUgbGluayBpdHNlbGYg Zmlyc3QuCisrICAgIGlmICgtbCAkcGlkZmlsZSkgeworKyAgICAgICAgd2FybiAicmVmdXNpbmcg dG8gdXNlIHBpZCBmaWxlICRwaWRmaWxlOiBpdCBpcyBhIHN5bWJvbGljIGxpbmtcbiI7CisrICAg ICAgICByZXR1cm47CisrICAgIH0KKyAgICAgcmV0dXJuIGlmIC1lICRwaWRmaWxlOworLSAgICBp ZiAoIG9wZW4oUElERklMRSwiPiRwaWRmaWxlIikpIHsKKy0gICAgICAgICBjbG9zZSBQSURGSUxF OworKworKyAgICAjIE9fQ1JFQVR8T19FWENMIGNyZWF0ZXMgdGhlIGZpbGUgYXRvbWljYWxseSBh bmQgZmFpbHMgaWYgYW55dGhpbmcKKysgICAgIyAoaW5jbHVkaW5nIGEgc3ltbGluayB0aGF0IHdh cyByYWNlZCBpbiBhZnRlciB0aGUgY2hlY2sgYWJvdmUpIGFscmVhZHkKKysgICAgIyBleGlzdHMg YXQgdGhlIHBhdGgsIGNsb3NpbmcgdGhlIHN5bWxpbmstZm9sbG93IC8gVE9DVE9VIHdpbmRvdy4K KysgICAgaWYgKCBzeXNvcGVuKG15ICRmaCwgJHBpZGZpbGUsIE9fV1JPTkxZfE9fQ1JFQVR8T19F WENMLCAwNjQ0KSApIHsKKysgICAgICAgICAjIGNob3duIHRoZSBvcGVuIGhhbmRsZSAoZmNob3du KSByYXRoZXIgdGhhbiB0aGUgcGF0aCwgc28gdGhlCisrICAgICAgICAgIyBvd25lcnNoaXAgY2hh bmdlIGNhbm5vdCBiZSByZWRpcmVjdGVkIHRocm91Z2ggYSBzd2FwcGVkLWluIHN5bWxpbmsuCisr ICAgICAgICAgY2hvd24gJHVpZCwgJGdpZCwgJGZoIGlmIGRlZmluZWQgJHVpZCBhbmQgZGVmaW5l ZCAkZ2lkOworKyAgICAgICAgIGNsb3NlICRmaDsKKyAgICAgfSBlbHNlIHsKKy0gICAgICAgICB3 YXJuICJjYW5ub3Qgd3JpdGUgdG8gJHBpZGZpbGU6ICQhXG4iOworKyAgICAgICAgIHdhcm4gImNh bm5vdCBjcmVhdGUgcGlkIGZpbGUgJHBpZGZpbGU6ICQhXG4iOworICAgICB9CisgfQorIAorQEAg LTEyODYsNyArMTMwNCw5IEBAIHN1YiBkZW1vbml6ZV9tZSAoJCkgeworICAgICAgICAgICAgIH0g ZWxzZSB7CisgICAgICAgICAgICAgICAgIGlmIChkZWZpbmVkICRwaWRmaWxlKXsKKyAgICAgICAg ICAgICAgICAgICAgJG1haW46OkNsZWFuZmlsZTMgPSAkcGlkZmlsZTsKKy0gICAgICAgICAgICAg ICAgICAgaWYgKG9wZW4oUElERklMRSwiPiRwaWRmaWxlIikpIHsKKysgICAgICAgICAgICAgICAg ICAgaWYgKC1sICRwaWRmaWxlKSB7CisrICAgICAgICAgICAgICAgICAgICAgICAgd2FybiAicmVm dXNpbmcgdG8gd3JpdGUgcGlkIGZpbGUgJHBpZGZpbGU6IGl0IGlzIGEgc3ltYm9saWMgbGlua1xu IjsKKysgICAgICAgICAgICAgICAgICAgfSBlbHNpZiAob3BlbihQSURGSUxFLCI+JHBpZGZpbGUi KSkgeworICAgICAgICAgICAgICAgICAgICAgICAgIHByaW50IFBJREZJTEUgIiQkXG4iOworICAg ICAgICAgICAgICAgICAgICAgICAgIGNsb3NlIFBJREZJTEU7CisgICAgICAgICAgICAgICAgICAg IH0gZWxzZSB7CgpkaWZmIC0tZ2l0IGEvbXJ0Zy5zcGVjIGIvbXJ0Zy5zcGVjCmluZGV4IDBiZjA5 ZjkuLjQ1MWY3NWUgMTAwNjQ0Ci0tLSBhL21ydGcuc3BlYworKysgYi9tcnRnLnNwZWMKQEAgLTEx LDcgKzExLDcgQEAKIFN1bW1hcnk6ICAgTXVsdGkgUm91dGVyIFRyYWZmaWMgR3JhcGhlcgogTmFt ZTogICAgICBtcnRnCiBWZXJzaW9uOiAgIDIuMTcuMTAKLVJlbGVhc2U6ICAgMTQlez9kaXN0fQor UmVsZWFzZTogICAxNSV7P2Rpc3R9CiBVUkw6ICAgICAgIGh0dHA6Ly9vc3Mub2V0aWtlci5jaC9t cnRnLwogU291cmNlMDogICBodHRwOi8vb3NzLm9ldGlrZXIuY2gvbXJ0Zy9wdWIvbXJ0Zy0le3Zl cnNpb259LnRhci5negogU291cmNlMTogICBodHRwOi8vb3NzLm9ldGlrZXIuY2gvbXJ0Zy9wdWIv bXJ0Zy0le3ZlcnNpb259LnRhci5nei5tZDUKQEAgLTM5LDYgKzM5LDggQEAgUGF0Y2gxOiAgICBt cnRnLTIuMTcuMi1zb2NrZXQ2LWZpeC5wYXRjaAogIyBQYXRjaDI6IHNvbWUgZGV2aWNlcyByZXR1 cm4gMioqMzItMiBvbiBpZlNwZWVkIChlLiBnLiBJQk0gRmlicmVDaGFubmVsIHN3aXRjaGVzKQog UGF0Y2gyOiAgICBtcnRnLTIuMTcuNC1jZmdtYWtlci1pZmhpZ2hzcGVlZC5wYXRjaAogUGF0Y2gz OiAgICBtcnRnLWNvbmZpZ3VyZS1jOTkucGF0Y2gKKyMgUGF0Y2g0OiBmaXhlcyBDVkUtMjAyNi03 MjY5NCwgYmFja3BvcnRlZCBmcm9tIHVwc3RyZWFtCitQYXRjaDQ6ICAgIG1ydGctMi4xNy4xMC1D VkUtMjAyNi03MjY5NC5wYXRjaAogTGljZW5zZTogICBHUEwtMi4wLW9yLWxhdGVyCiBSZXF1aXJl cyhwb3N0KTogc3lzdGVtZC11bml0cwogUmVxdWlyZXMocHJldW4pOiBzeXN0ZW1kLXVuaXRzCkBA IC04NCw2ICs4Niw3IEBAIEN1c3RvbSBTRUxpbnV4IHBvbGljeSBtb2R1bGUKICVwYXRjaCAtUDEg LXAxIC1iIC5zb2NrZXQ2CiAlcGF0Y2ggLVAyIC1wMSAtYiAuaWZoaWdoc3BlZWQKICVwYXRjaCAt UDMgLXAxIC1iIC5jOTkKKyVwYXRjaCAtUDQgLXAxIC1iIC5DVkUtMjAyNi03MjY5NAogCiBmb3Ig aSBpbiBkb2MvbXJ0Zy1mb3J1bS4xIGRvYy9tcnRnLXNxdWlkLjEgQ0hBTkdFUzsgZG8KICAgICBp Y29udiAtZiBpc28tODg1OS0xIC10IHV0Zi04IDwgIiRpIiA+ICIke2l9XyIKQEAgLTIxMiw2ICsy MTUsMTAgQEAgZmkKICVlbmRpZgogCiAlY2hhbmdlbG9nCisqIFdlZCBBdWcgMjYgMjAyNiBWaXRl enNsYXYgQ3Job25layA8dmNyaG9uZWtAcmVkaGF0LmNvbT4gLSAyLjE3LjEwLTE1CistIEZpeCBD VkUtMjAyNi03MjY5NDogc3ltbGluay1mb2xsb3dpbmcgcHJpdmlsZWdlIGVzY2FsYXRpb24gaW4g UElEIGZpbGUgaGFuZGxpbmcKKyAgUmVzb2x2ZXM6ICMyNTEzODI5CisKICogVGh1IEp1bCAxNiAy MDI2IEZlZG9yYSBSZWxlYXNlIEVuZ2luZWVyaW5nIDxyZWxlbmdAZmVkb3JhcHJvamVjdC5vcmc+ IC0gMi4xNy4xMC0xNAogLSBSZWJ1aWx0IGZvciBodHRwczovL2ZlZG9yYXByb2plY3Qub3JnL3dp a2kvRmVkb3JhXzQ1X01hc3NfUmVidWlsZAogCg==