Bug 2557997 (CVE-2026-114097)
| Summary: | CVE-2026-114097 dulwich: dulwich: Arbitrary code execution via symlink path traversal during branch filtering | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akhatavk, aos-team-art-private, asdas, dpaolell, dschmidt, gbenhaim, jdelft, jdobes, jlanda, jmitchel, jupierce, kgaikwad, kshier, lgarciaa, mbiarnes, niyer, orabin, ppalepu, ppostler, prdhamdh, rbobbitt, rhel-process-autobot, sghai, sidsharm, simaishi, stcannon, suppawar, twaugh, vlaad, watson-tool-maintainers, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Dulwich. This vulnerability allows an attacker to achieve arbitrary code execution by tricking a user into running branch filtering operations on a specially crafted Git repository. Because temporary files persist between commit processing cycles, symbolic links created in earlier commits can redirect subsequent file write operations outside the working directory, allowing an attacker to overwrite sensitive files such as executable Git hook scripts.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-21 00:58:46 UTC
|