Bug 2525129
| Summary: | CVE-2026-7774 asahi-installer: Python tarfile: Arbitrary file write via crafted link entries [fedora-all] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ganesh <gnaik> |
| Component: | asahi-installer | Assignee: | Davide Cavalca <davide> |
| Status: | ON_QA --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | rawhide | CC: | asahi-sig, davide |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking, Triaged |
| Target Release: | --- | Flags: | michel:
needinfo?
(davide) |
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | {"flaws": ["7a19d553-e02b-4d1a-a8a1-6b5514246c3c"]} | ||
| Fixed In Version: | asahi-installer-0.9.2-4.fc46 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2484827 | ||
|
Description
Ganesh
2026-08-27 17:06:39 UTC
fedora-cve-triage 0.27.1 (analysis 1): asahi-installer bundles python 3.13.9, older than the fix in 3.13.14 — the bug is real (bundled-library) This is a real finding rather than a false positive: the bug should stay open until the fix reaches this package. fedora-cve-triage 0.27.1 (analysis 2; builds asahi-installer-0.9.1-1.fc43, asahi-installer-0.9.1-1.fc44, asahi-installer-0.9.2-2.fc45, asahi-installer-0.9.2-4.fc46): asahi-installer bundles python 3.13.17, at or past the fix in commit 0478bd83d82b (in v3.13.17) — bodhi-check's to close against the update that brought it (bundled-library) fedora-cve-triage 0.27.1 (analysis 3; builds asahi-installer-0.9.1-1.fc43, asahi-installer-0.9.1-1.fc44, asahi-installer-0.9.2-2.fc45, asahi-installer-0.9.2-4.fc46): asahi-installer is fixed on F46 (bundles python 3.13.17, at or past the fix in commit 0478bd83d82b (in v3.13.17)) but not on F43, F44, F45 (bundles python 3.13.9, older than the fix in 3.13.14) — the bug is real (bundled-library) This is a real finding rather than a false positive: the bug should stay open until the fix reaches this package. fedora-cve-triage 0.27.1 (analysis 3; builds asahi-installer-0.9.1-1.fc43, asahi-installer-0.9.1-1.fc44, asahi-installer-0.9.2-2.fc45, asahi-installer-0.9.2-4.fc46): fixed on some releases, still unfixed on F43, F44, F45 (bodhi-check) asahi-installer is fixed on F46 (bundles python 3.13.17, at or past the fix in commit 0478bd83d82b (in v3.13.17)) but not on F43, F44, F45 (bundles python 3.13.9, older than the fix in 3.13.14) — the bug is real (bundled-library) This bug covers every release of its family, and the fix has reached some of them but not all. Fixed by: asahi-installer-0.9.2-4.fc46 (FEDORA-2026-811cfc71b8) Still unfixed on: F43, F44, F45 Leaving the bug open. If those releases are meant to be built too, this is the reminder; if they are not affected or are deliberately being left, say so here and the bug can be closed. FEDORA-2026-9ff6e78b75 (asahi-installer-0.9.2-4.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-9ff6e78b75 FEDORA-2026-9ff6e78b75 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-9ff6e78b75` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-9ff6e78b75 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-9ff6e78b75 (asahi-installer-0.9.2-4.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report. |