23 matches found
SUSE SLES16 Security Update : apache-ivy (SUSE-SU-2026:22858-1)
The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22858-1 advisory. This update for apache-ivy fixes the following issue: - CVE-2026-26032: directory traversal sequences in module coordinates can allow...
SUSE-SU-2026:22858-1 Security update for apache-ivy
This update for apache-ivy fixes the following issue: - CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting arbitrary files outside the configured "buildRoot" directory bsc1271727. Changes for apache-ivy: - Upgrade to 2.6.0: + the ivy:retrieve task failed whe...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal in the file-op delete path. An attacker can delete files outside the intended build root by sending a crafted low-level build API request with FileActionRm.Path values such as .. or ../victim. The vulnerable path...
SUSE CVE-2026-26032
The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...
Linux Distros Unpatched Vulnerability : CVE-2026-26032
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is do...
CVE-2026-26032
The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...
CVE-2026-26032 Apache Ivy: PackagerResolver path traversal vulnerability
The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...
CVE-2026-26032
The PackagerResolver in Apache Ivy (versions 2.0.0 to 2.5.3) is vulnerable to a directory traversal attack. An attacker with access to a packager repository can inject ../ sequences into module coordinates within ivy.xml files. When Ivy downloads and repackages these artifacts, the traversal sequ...
CVE-2026-26032 Apache Ivy: PackagerResolver path traversal vulnerability
The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...
EUVD-2026-44763
The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is calculated based on...
GO-2026-5589 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko...
CVE-2026-42574
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
EUVD-2026-28932
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
CVE-2026-42574
The CVE-2026-42574 issue affects apko dirFS used to build/publish OCI images. A crafted APK could place a TypeSymlink tar entry whose target points outside the build root, enabling traversal to host paths via subsequent directory creation or write operations within the same or later archive. Root...
CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
Apko path traversal vulnerability
Apko is an open-source OCI image builder based on APK. In versions 0.14.8 to 1.2.5 of Apko, there was a path traversal vulnerability. This vulnerability occurred because specially crafted APK packages could install entries that pointed to directories other than the build root directory. This...
Symlink Attack
Overview Affected versions of this package are vulnerable to Symlink Attack through the DirFS process. An attacker can gain unauthorized access to files outside the intended build root by crafting a malicious archive containing a symlink entry that points outside the build root, followed by...
GHSA-QQ3R-W4HJ-GJP6 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
Impact A crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could traverse that symlink to reach host paths the build user could write to. The root cause was the...