openSUSE-SU-2026:20915-1
Security update for sshfs
Severidad por fuente
Ninguna fuente da una puntuación CVSS.
La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.
Descripción
This update for sshfs fixes the following issues: Changes in sshfs: - Update to 3.7.6: - Added new maintainer: abhinavagarwal07 Abhinav Agarwal - CVE-2026-47187: Fixed critical vulnerability - Symlink Escape: Rogue SFTP Server to Local File Read/Write), credit to abhinavagarwal07 (bsc#1267017) - New -o contain_symlinks and -o no_contain_symlinks to control symlink containment behavior - CVE-2026-48711: Fixed high severity vulnerability - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), credit to abhinavagarwal07 (bsc#1267016) - Fixed null-deref warning in tokenize_on_space, promote strict-warnings to required - Added a number of tests in CI, including rename, chmod, fsync, statvfs values, error paths, option coverage - Fixed malformed SFTP reply handling - Update to 3.7.5: * Implement connect to vsock * use latest major version for actions/checkout * Fix memleak in cache after readlink * Fill stat info when returning cached data for readdir * ipv6 support for directport connection - reverts to original fork - Don't globstar files in shared directory _bindir. - build the man page
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| openSUSE Leap 16.0 | sshfs | 3.7.6-bp160.1.1 |