{
  "threat_severity" : "Moderate",
  "public_date" : "2026-06-29T13:00:00Z",
  "bugzilla" : {
    "description" : "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
    "id" : "2490283",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2490283"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-59",
  "details" : [ "attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.", "A flaw was found in the `attr` package. This vulnerability allows a local attacker to perform a symlink traversal attack by replacing a pathname component with a symbolic link - either during directory hierarchy traversal by `getfattr` or during backup restoration by `setfattr`, which reads and resolves full pathnames from backup files. In both cases, when these utilities are executed by a privileged process over a path controlled by the attacker, this can lead to local privilege escalation." ],
  "statement" : "This Moderate severity flaw in the `getfattr` utility allows a local attacker to achieve privilege escalation. Exploitation requires a privileged process to invoke `getfattr` on a path controlled by the attacker, where a symbolic link can redirect operations to arbitrary files.",
  "acknowledgement" : "Red Hat would like to thank Alexander Peslyak <solar@openwall.com> and Andrew Tridgell <tridge60@gmail.com> for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-25T00:00:00Z",
    "advisory" : "RHSA-2026:59380",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "attr-0:2.6.0-1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-08-18T00:00:00Z",
    "advisory" : "RHSA-2026:56133",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "attr-0:2.6.0-1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60226",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "attr-0:2.6.0-1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:60226",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "attr-0:2.6.0-1.el9_8"
  }, {
    "product_name" : "Cert Manager support for Red Hat OpenShift release 1.19",
    "release_date" : "2026-09-03T00:00:00Z",
    "advisory" : "RHSA-2026:63135",
    "cpe" : "cpe:/a:redhat:cert_manager:1.19::el9",
    "package" : "cert-manager/cert-manager-operator-rhel9:1788348522"
  }, {
    "product_name" : "Cert Manager support for Red Hat OpenShift release 1.19",
    "release_date" : "2026-09-03T00:00:00Z",
    "advisory" : "RHSA-2026:63138",
    "cpe" : "cpe:/a:redhat:cert_manager:1.19::el9",
    "package" : "cert-manager/jetstack-cert-manager-acmesolver-rhel9:1788348571"
  }, {
    "product_name" : "Cert Manager support for Red Hat OpenShift release 1.19",
    "release_date" : "2026-09-03T00:00:00Z",
    "advisory" : "RHSA-2026:63138",
    "cpe" : "cpe:/a:redhat:cert_manager:1.19::el9",
    "package" : "cert-manager/jetstack-cert-manager-rhel9:1788348571"
  }, {
    "product_name" : "Red Hat Discovery 2",
    "release_date" : "2026-08-31T00:00:00Z",
    "advisory" : "RHSA-2026:61783",
    "cpe" : "cpe:/a:redhat:discovery:2::el9",
    "package" : "discovery/discovery-server-rhel9:1788205779"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-07-02T00:00:00Z",
    "advisory" : "RHSA-2026:34889",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "attr-main-2.6.0-9.1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Fix deferred",
    "package_name" : "attr",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "attr",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-54371\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54371" ],
  "name" : "CVE-2026-54371",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}