Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | yggdrasil-worker-package-manager | 0:0.2.3-6.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | yggdrasil-worker-package-manager-debuginfo | 0:0.2.3-6.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | yggdrasil-worker-package-manager-debugsource | 0:0.2.3-6.el10_0 |
Vulnerabilities 1
-
Medium 6.4
TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2456336
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27732.json
-
report
https://access.redhat.com/security/cve/CVE-2026-32282
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-32282
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32282
-
article
https://go.dev/cl/763761
-
article
https://go.dev/issue/78293
-
article
https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU
-
advisory
https://pkg.go.dev/vuln/GO-2026-4864