Skip to content

Commit c4b6797

Browse files
dongsuparkdongsupark
authored
Merge pull request #3990 from flatcar/buildbot/monthly-glsa-metadata-updates-2026-05-01
Monthly GLSA metadata 2026-05-01
2 parents 400b4da + fa3b9c0 commit c4b6797

6 files changed

Lines changed: 103 additions & 18 deletions

File tree

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
11
-----BEGIN PGP SIGNED MESSAGE-----
22
Hash: SHA512
33

4-
MANIFEST Manifest.files.gz 606986 BLAKE2B a1a7c8f65fa2d227109ddc598ecd792925cbf4dd59fd721d0e3d30d2ca2d680abe6f48efd8c7f747286a8b9b83dd77ab08effbd12fd5cff7aea22ff05b4b3249 SHA512 1d46d342b6898d53ef6e234a4ca25659b7a64373067f8d911b4a7efe73a227178e519cb54901fc15172d8a4113aeafaf14390ce5e552d1e17e50d3297a8f0701
5-
TIMESTAMP 2026-04-01T07:08:01Z
4+
MANIFEST Manifest.files.gz 607306 BLAKE2B 92017b6799c6b9c6711d15259ccc5be7553c29a3562d24a367c7d7fa515cce981f1217aad923c07afa53479c855092c79ea478c7db5c27df5970742f0481eaaf SHA512 4fb6dcd2062715f4926aa685e41323a46d1b1f83e7be9008f32bd997a354c2cf495d9a497cf42a39b59bc734dabbeb4a8cb987031227e5f6741d4c6fc3ec95bf
5+
TIMESTAMP 2026-05-01T07:08:09Z
66
-----BEGIN PGP SIGNATURE-----
77

8-
iQKvBAEBCgCZFiEE4dartjv8+0ugL98c7FkO6skYklAFAmnMxFEbFIAAAAAABAAO
8+
iQKvBAEBCgCZFiEE4dartjv8+0ugL98c7FkO6skYklAFAmn0UVkbFIAAAAAABAAO
99
bWFudTIsMi41KzEuMTEsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z
1010
Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRFMUQ2QUJCNjNCRkNGQjRCQTAyRkRG
11-
MUNFQzU5MEVFQUM5MTg5MjUwAAoJEOxZDurJGJJQCCMQAJqLP7jt/MtqrWUu66/N
12-
g4C4QYQY65p5tHkq6lFs/X24MeAtuRUgKbaOQm02KZJNb61bvZBdgtNE8P14qWJX
13-
LtJ8hqYOJiDT3hDhnL5Z+UbjIxDdn6m2udztvXvdkgRiQEUnhaTv8BpeOwvdGnZ4
14-
nswP+jJ5hMK4tYuMFy96jO39jKAbKo4HNYQCW8CJe4/HRSboXe20Z+N74xqq5M2e
15-
aajm7K7adRALxIYM2Ih3V64LfVsPn31TzMfXaFk0y4p3f82uZ/hTophDZIdePR0M
16-
a1hkcQRPdHOmbVftt3llye5XoSmq0d+Pie7axQUJVwlFd+gORzNqvK3U+9PeeKjB
17-
FU6wU1vmR2mlIE90prbdDKPkoNhOnn9CVLHRHYl0M8WLh4TATrDl0HcUbEOrE/CC
18-
vay9V4s+lABWZh2D/BToIrWUs0UMpWtt/5e5ZANrECj7T5ExWngHY7zCCDn1dySw
19-
Poabc3KIQlBzmstxNBqTUIvxdaxhvF+Hh7Fj4Grzzmsgio76mBhQLUF2ML8vquVe
20-
ipeNd0fnGIWUN6eGdC6BZ73wVC66r53bSjHPMa+N6KyCgmHbGP/HCE0GuUvnKtBc
21-
joBONGhatuZEM3zLIMLLxHg4cMYVEF2vA19Mh89OhYQDlIbEf5Bc/LpPYOtN3LdD
22-
vHcXTmn2vbBiAIieKmqm6Elk
23-
=iTBC
11+
MUNFQzU5MEVFQUM5MTg5MjUwAAoJEOxZDurJGJJQehAQAIbfYrOfZXXVM5NCsVSH
12+
s9QR1OC6QdiSTci3jmOmSqRzMQtIEq0MpOmuFYtJuoCZcGuE8jKpSyx12PArZRYW
13+
abGU7C+hGt6qF73p47FewiTLHQv3kBEKV8H/sJCuFv6aoOqczSxFnpJiIDP2Cr2O
14+
5oQtnpvS06Yu+GcRzkwiKQ05UP4yprfoFk7Y7RlaTniVoSNdXwTEVF33CuJNQyT8
15+
7mD68mxYAlL71M56yE7a6AZPMd+QpqJf+mqpGBMAO3A9J0UHdYTnQG4RZZsgLvvy
16+
Zg0hSafEedVmokw5Iw8QqGdBHscCoL2H5I+0rPhjwHto9MrD5lmFYWh10xi3ncGW
17+
EV7YKfY7nzr2UdPWyingtMcHXgUz4oo1rNHSfBJ9bNizqxraJUFo4ZEC7xTHyeiB
18+
yjKPVOFXkr0njGso3O6Xo+KRyG5bfNWst3Bz5E6rxlGozwEZtvtfOHYrUe8vzQHp
19+
LNmczBy8M13dMC6DIYtalp9Gdi9K8Si+bFCepe9Ux92DFDcaymT3WyJauva+3NT/
20+
g76MRRW9Ez/p7h1J0wRYF0GLLaYC7l7kr4pavUHu8VvP0SS/fQanCmIpnPYUUqwe
21+
/rzIzuZGtU1lW0ynXlGiosxh3zIQgw7WthjlsQTWH3XiRu02ZKrkCDY56ZDmmGl0
22+
INhWuascPpUN8zEuK0URt1zS
23+
=xCZR
2424
-----END PGP SIGNATURE-----

‎sdk_container/src/third_party/portage-stable/metadata/glsa/Manifest.files.gz‎

320 Bytes
Binary file not shown.

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202604-03.xml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202604-03">
4+
<title>FUSE: Multiple Vulnerabilities</title>
5+
<synopsis>Multiple vulnerabilities have been found in FUSE, the worst of which can lead to code execution.</synopsis>
6+
<product type="ebuild">fuse</product>
7+
<announced>2026-04-17</announced>
8+
<revised count="1">2026-04-17</revised>
9+
<bug>971552</bug>
10+
<access>remote</access>
11+
<affected>
12+
<package name="sys-fs/fuse" auto="yes" arch="*">
13+
<unaffected range="ge" slot="3">3.18.1</unaffected>
14+
<vulnerable range="lt" slot="3">3.18.1</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>FUSE (Filesystem in Userspace) is an interface for userspace programs to export a filesystem to the Linux kernel.</p>
19+
</background>
20+
<description>
21+
<p>The following vulnerabilities have been discovered in FUSE: a NULL pointer dereference (when running with the NUMA architecture) and a use-after-free. The worst of which can lead to code execution. Please review the CVE identifiers referenced below for details.</p>
22+
</description>
23+
<impact type="normal">
24+
<p>The following is a possible outcome: denial of service (crash) and potential code execution.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All FUSE users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=sys-fs/fuse-3.18.1:3"
35+
</code>
36+
</resolution>
37+
<references>
38+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2026-33150">CVE-2026-33150</uri>
39+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2026-33179">CVE-2026-33179</uri>
40+
</references>
41+
<metadata tag="requester" timestamp="2026-04-17T19:33:25.077082Z">csfore</metadata>
42+
<metadata tag="submitter" timestamp="2026-04-17T19:33:25.079638Z">csfore</metadata>
43+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/glsa-202604-04.xml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
3+
<glsa id="202604-04">
4+
<title>DTrace: Arbitrary file creation via dtprobed</title>
5+
<synopsis>A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.</synopsis>
6+
<product type="ebuild">dtrace</product>
7+
<announced>2026-04-17</announced>
8+
<revised count="1">2026-04-17</revised>
9+
<bug>971491</bug>
10+
<access>local</access>
11+
<affected>
12+
<package name="dev-debug/dtrace" auto="yes" arch="*">
13+
<unaffected range="ge">2.0.6</unaffected>
14+
<vulnerable range="lt">2.0.6</vulnerable>
15+
</package>
16+
</affected>
17+
<background>
18+
<p>DTrace is a dynamic tracing tool for analysing or debugging the whole system. Specifically, dtprobed is a component of the DTrace system that keeps track of USDT probes within running processes, parsing and storing the DOF they provide for later consumption by dtrace proper.</p>
19+
</background>
20+
<description>
21+
<p>A vulnerability has been found in dtprobed that allows for arbitrary file creation through specially crafted USDT provider names.</p>
22+
</description>
23+
<impact type="normal">
24+
<p>The worst possible outcome is the ability for an attacker to run arbitrary code via the maliciously created file.</p>
25+
</impact>
26+
<workaround>
27+
<p>There is no known workaround at this time.</p>
28+
</workaround>
29+
<resolution>
30+
<p>All DTrace users should upgrade to the latest version:</p>
31+
32+
<code>
33+
# emerge --sync
34+
# emerge --ask --oneshot --verbose ">=dev-debug/dtrace-2.0.6"
35+
</code>
36+
</resolution>
37+
<references>
38+
<uri link="https://nvd.nist.gov/vuln/detail/CVE-2026-21991">CVE-2026-21991</uri>
39+
</references>
40+
<metadata tag="requester" timestamp="2026-04-17T20:47:15.308512Z">csfore</metadata>
41+
<metadata tag="submitter" timestamp="2026-04-17T20:47:15.311877Z">csfore</metadata>
42+
</glsa>

‎sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.chk‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
Wed, 01 Apr 2026 07:08:00 +0000
1+
Fri, 01 May 2026 07:08:08 +0000

‎sdk_container/src/third_party/portage-stable/metadata/glsa/timestamp.commit‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
d2078931cc4cb1c6d04130dacbed885a7d2bf71c 1773030064 2026-03-09T04:21:04Z
1+
f40d2fdd24a34342a4c050396f064a038ebebb9b 1776459195 2026-04-17T20:53:15Z

0 commit comments

Comments
 (0)