CVE-2026-79699

Description

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

Traduire en français

Produits concernés

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Red Hat Hardened Images
• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Dev Spaces
• Red Hat OpenShift Virtualization 4
• Red Hat Quay 3

Scores CVSS

Faiblesses (CWE)

• CWE-59

Références

• https://access.redhat.com/security/cve/CVE-2026-79699
• https://bugzilla.redhat.com/show_bug.cgi?id=2523408

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories