EUVD-2026-3402

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages...

GHSA-2657-3C98-63JQ esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages

Summary The commit does not actually fix the path traversal bug. path.Clean basically normalizes a path but does not prevent absolute paths in a malicious tar file. PoC This test file can demonstrate the basic idea pretty easily: go package server import "archive/tar" "bytes" "compress/gzip"...

Malicious Package

Overview chai-bin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MiracleLinux 8 : grub2-2.02-78.0.2.el8 (AXSA:2020-283:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-283:03 advisory. grub2: grub2-set-bootflag utility causes grubenv corruption rendering the system non-bootable CVE-2019-14865 Tenable has extracted the preceding description...

MiracleLinux 8 : webkit2gtk3-2.36.7-1.el8.3.ML.1 (AXSA:2023-5310:08)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5310:08 advisory. WebKitGTK: use-after-free leads to arbitrary code execution CVE-2023-28205 Tenable has extracted the preceding description block directly from the MiracleLin...

MiracleLinux 8 : libxml2-2.9.7-18.el8_9 (AXSA:2024-7397:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-7397:01 advisory. libxml2: crafted xml can cause global buffer overflow CVE-2023-39615 Tenable has extracted the preceding description block directly from the MiracleLinux...

MiracleLinux 9 : libsndfile-1.0.31-8.el9_5.2 (AXSA:2024-9490:04)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9490:04 advisory. libsndfile: Segmentation fault error in oggvorbis.c:417 vorbisanalysiswrote CVE-2024-50612 Tenable has extracted the preceding description block directly fro...

MiracleLinux 9 : rsync-3.2.3-9.el9.1 (AXSA:2022-3960:06)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3960:06 advisory. zlib: A flaw found in zlib when compressing not decompressing certain inputs CVE-2018-25032 Tenable has extracted the preceding description block directly fr...

MiracleLinux 9 : libqb-2.0.6-4.el9 (AXSA:2023-6949:05)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6949:05 advisory. libqb: Buffer overflow in logblackbox.c CVE-2023-39976 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...

MiracleLinux 8 : yajl-2.1.0-11.el8 (AXSA:2022-4173:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-4173:02 advisory. yajl: heap-based buffer overflow when handling large inputs due to an integer overflow CVE-2022-24795 Tenable has extracted the preceding description block...

MiracleLinux 8 : cups-2.2.6-51.el8.1 (AXSA:2023-6373:09)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6373:09 advisory. cups: Information leak through Cups-Get-Document operation CVE-2023-32360 Tenable has extracted the preceding description block directly from the MiracleLinu...

MiracleLinux 9 : cups-filters-1.28.7-11.el9.1 (AXSA:2023-5962:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5962:03 advisory. cups-filters: remote code execution in cups-filters, beh CUPS backend CVE-2023-24805 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : nss-3.79.0-11.el8 (AXSA:2023-5224:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-5224:01 advisory. nss: Arbitrary memory write via PKCS 12 CVE-2023-0767 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...

MiracleLinux 9 : postfix-3.5.25-1.el9 (AXSA:2024-9252:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9252:01 advisory. postfix: SMTP smuggling vulnerability CVE-2023-51764 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...

MiracleLinux 7 : qemu-kvm-1.5.3-175.el7.4 (AXSA:2021-1882:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1882:03 advisory. QEMU: ide: atapi: OOB access while processing read commands CVE-2020-29443 Tenable has extracted the preceding description block directly from the MiracleLin...

MiracleLinux 8 : mod_auth_openidc:2.3 (AXSA:2024-8687:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8687:01 advisory. modauthopenidc: DoS when using OIDCSessionType client-cookie and manipulating cookies CVE-2024-24814 Tenable has extracted the preceding description block...

MiracleLinux 8 : ruby:2.6 (AXSA:2022-3745:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3745:01 advisory. Ruby: Buffer overrun in String-to-Float conversion CVE-2022-28739 Tenable has extracted the preceding description block directly from the MiracleLinux securi...

MiracleLinux 8 : sssd-2.9.4-3.el8 (AXSA:2024-8333:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8333:06 advisory. sssd: Race condition during authorization leads to GPO policies functioning inconsistently CVE-2023-3758 Tenable has extracted the preceding description bloc...

MiracleLinux 9 : python3.9-3.9.18-1.el9 (AXSA:2023-6804:05)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6804:05 advisory. python: tarfile module directory traversal CVE-2007-4559 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 7 : pacemaker-1.1.23-1.el7.1 (AXSA:2020-992:04)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-992:04 advisory. pacemaker: ACL restrictions bypass CVE-2020-25654 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory. Note...