{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-66484-els_os-oraclelinux6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-28T11:35:44Z",
      "generator": {
        "date": "2026-10-28T11:35:44Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-66484-ELS_OS-ORACLELINUX6ELS",
      "initial_release_date": "2026-08-10T11:17:00Z",
      "revision_history": [
        {
          "date": "2026-08-10T11:17:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-28T11:35:44Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2026-66484"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 6",
                "product": {
                  "name": "Oracle Linux 6",
                  "product_id": "Oracle-Linux-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.i686",
                "product": {
                  "name": "cpio-0:2.10-13.el6.i686",
                  "product_id": "cpio-0:2.10-13.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/cpio@2.10-13.el6?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.x86_64",
                "product": {
                  "name": "cpio-0:2.10-13.el6.x86_64",
                  "product_id": "cpio-0:2.10-13.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/cpio@2.10-13.el6?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                "product": {
                  "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                  "product_id": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/cpio@2.10-13.el6.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                "product": {
                  "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                  "product_id": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/cpio@2.10-13.el6.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686"
        },
        "product_reference": "cpio-0:2.10-13.el6.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.i686"
        },
        "product_reference": "cpio-0:2.10-13.el6.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64"
        },
        "product_reference": "cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cpio-0:2.10-13.el6.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
        },
        "product_reference": "cpio-0:2.10-13.el6.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-66484",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
      },
      "notes": [
        {
          "category": "description",
          "text": "GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the link_to_name function without equivalent sanitization before calling link function. A tar archive provided by an attacker, containing a hard-link entry whose linkname is set to an absolute path outside the extraction directory, can cause cpio to create a hard link to an existing file outside the intended extraction directory, breaking the expected guarantee of --no-absolute-filenames and allowing archive-controlled linkage to external files.\n\nThis issue has been fixed in commit e2b9cbdd3354d2b1569b7390d1bc15c1930559ad",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "Oracle-Linux-6:cpio-0:2.10-13.el6.i686",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
          "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-66484"
        },
        {
          "category": "external",
          "summary": "https://cert.pl/en/posts/2026/08/CVE-2026-66484",
          "url": "https://cert.pl/en/posts/2026/08/CVE-2026-66484"
        },
        {
          "category": "external",
          "summary": "https://git.savannah.gnu.org/cgit/cpio.git",
          "url": "https://git.savannah.gnu.org/cgit/cpio.git"
        }
      ],
      "release_date": "2026-08-10T11:17:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-25T11:11:09.059857Z",
          "details": "Deprioritize: Exploitation requires a user or automated job to extract a malicious tar with cpio specifically in copy-in mode using --no-absolute-filenames, so exposure on non‑interactive server/VM workloads is limited. The flaw can only create a hard link to an already‑existing file outside the extraction tree; it does not write arbitrary data, change permissions, or bypass normal file access controls, and hard links must reside on the same filesystem and target regular files. With no availability impact and only conditional, low‑leverage integrity/confidentiality effects, this is a low‑priority issue for managed enterprise deployments.",
          "product_ids": [
            "Oracle-Linux-6:cpio-0:2.10-13.el6.i686",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.i686",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.tuxcare.els1.x86_64",
            "Oracle-Linux-6:cpio-0:2.10-13.el6.x86_64"
          ]
        }
      ]
    }
  ]
}