NetSight
IP …
medium5.9

CVE-2026-58015

A flaw was found in GLib.

Impact

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

Affected products

VendorProductAffected versions
GnomeGlib
before 2.88.1
RedhatEnterprise Linux
Versions 6.0, 7.0, 8.0, 9.0, 10.0
Red HatRed Hat OpenShift AI 3.2
Versions patch: 1790703494, patch: 1790703586, patch: 1790703497, patch: 1790703506, patch: 1790703568, patch: 1790703590
Red HatRed Hat Update Infrastructure 5
Versions patch: 1788880464, patch: 1788765051, patch: 1788880581, patch: 1788880456, patch: 1788880445, patch: 1787135742
Red HatCert Manager Support For Red Hat OpenShift Release 1.20
Versions patch: 1790272426, patch: 1790223279, patch: 1790223719, patch: 1790589998, patch: 1790589914, patch: 1790589855
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support
Version patch: 0:2.80.4-4.el10_0.17
Red HatRed Hat OpenShift AI 3.4
Versions patch: 1790703631, patch: 1790703597, patch: 1790703542, patch: 1790703539, patch: 1790703545, patch: 1791232048
Red HatRed Hat OpenShift AI 3.0
Versions patch: 1790276974, patch: 1790277045, patch: 1790276884, patch: 1790276886, patch: 1790276889
Red HatRed Hat Enterprise Linux AI 3.5
Versions patch: 1793194834, patch: 1793194815, patch: 1793135861, patch: 1793206758, patch: 1793135863, patch: 1793194817
Red HatRed Hat Enterprise Linux 10
Version patch: 0:2.80.4-12.el10_2.21
Red HatRed Hat AI Inference Server 3.5
Versions patch: 1791473631, patch: 1791473614, patch: 1791427182, patch: 1791818357, patch: 1791425869, patch: 1791803821
Red HatRed Hat Discovery 2
Versions patch: 1788206196, patch: 1788205779
Red HatCert Manager Support For Red Hat OpenShift Release 1.17
Versions patch: 1791371080, patch: 1791371069, patch: 1791378395, patch: 1791970484, patch: 1791788287
Red HatRed Hat Enterprise Linux 9
Version patch: 0:2.68.4-19.el9_8.9

Weakness classification

CWE-22

References