Description (CNA)
A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Enterprise Linux 10 | unaffected 2:1.35-13.el10_2 before * |
| Red Hat / Red Hat Enterprise Linux 8 | unaffected 2:1.30-13.el8_10 before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 2:1.34-13.el9_8 before * |
| Red Hat / Red Hat Discovery 2 | unaffected 1788205779 before * |
| Red Hat / Red Hat Hardened Images | unaffected 1.35-10.hum1 before * |
| Red Hat / Red Hat Update Infrastructure 5 | unaffected 1788880445 before * |
| Red Hat / Red Hat Update Infrastructure 5 | unaffected 1788880464 before * |
| Red Hat / Red Hat Update Infrastructure 5 | unaffected 1788880456 before * |
| Red Hat / Red Hat Update Infrastructure 5 | unaffected 1788765051 before * |
| Red Hat / Red Hat Update Infrastructure 5 | unaffected 1788880581 before * |
| Red Hat / Red Hat Enterprise Linux 6 | affected |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
CWE
CWE-434
References
- https://access.redhat.com/errata/RHSA-2026:61581
- https://access.redhat.com/errata/RHSA-2026:61586
- https://access.redhat.com/errata/RHSA-2026:61783
- https://access.redhat.com/errata/RHSA-2026:66018
- https://access.redhat.com/errata/RHSA-2026:66514
- https://access.redhat.com/errata/RHSA-2026:70390
- https://access.redhat.com/security/cve/CVE-2026-5704
- https://bugzilla.redhat.com/show_bug.cgi?id=2455360
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.