Bug 2566260

Summary: CVE-2026-115905 ruff: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE [epel-all]
Product: [Fedora] Fedora EPEL Reporter: aedmond
Component: ruffAssignee: Ben Beasley <code>
Status: ASSIGNED --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: epel10CC: code, decathorpe, python-packagers-sig, rust-sig
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["a882e4b9-4d3a-421b-86d5-9f3fd525c169"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2548378    
Bug Blocks: 2560934    

Description aedmond 2026-11-03 20:19:05 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata in src/read/stream.rs. A crafted archive can therefore appear benign to a component that inspects the central directory but cause a streaming extractor to write a different attacker-selected path and content, potentially overwriting files used by a downstream service. This issue is fixed in version 9.0.5.
Comment 1 Ben Beasley 2026-11-04 10:32:03 UTC 
This is a legitimate problem. It can be fixed by updating rust-zip to 9.0.5 or later (which, in turn, will require a nontrivial rust-zstd update), and updating ruff to 0.17.4 or later (not yet released, but coming soon) so that it uses v9 of the zip crate. See https://forge.fedoraproject.org/rust/backlog/issues/47 for details and general coordination.