Summary
[2.6.0-1]
- rebase to 2.6.0 to fix the following CVEs:
- CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (RHEL-186121)
- fix couple of rpminspect warnings
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | attr | 0:2.6.0-1.el8_10 |
| Oracle Linux · 8 | libattr | 0:2.6.0-1.el8_10 |
| Oracle Linux · 8 | libattr-devel | 0:2.6.0-1.el8_10 |
Vulnerabilities 1
-
High 7.1
attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr
attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attacke…