CLSA-2026-1785340982
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1785340982.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1785340982
- Upstream
CVE (3)
- CVE-2026-11386
- CVE-2026-12391
- CVE-2026-9494
- Published
- 2026-07-29T16:03:13Z
- Modified
- 2026-10-26T09:30:54Z
- Summary
- Fix CVE(s): CVE-2026-11386, CVE-2026-12391, CVE-2026-9494
- Details
-
- Bump epoch to supersede the vendor package in the ELS channel (matches the ubuntu16/ubuntu18 ELS branches).
- Add gpg to Build-Depends: the build-time test suite (uaclient/tests/test_gpg.py) invokes the gpg binary, which is not present in the minimal ELS build chroot.
- Add debian/mark_skip_pytests.sh and invoke it from debian/rules: on FIPS-capable build hosts running in a disabled state, some status/FIPS pytests fail at build time; skip only those, only in that environment (matches the ubuntu16/ubuntu18 ELS branches).
- Skip tools/check-versions-are-consistent.py in override_dh_auto_build: its regex does not handle a package epoch and misparses our 1:34~20.04+tuxcare.elsN version, aborting the build; version.py already matches the shipped upstream version (34).
- SECURITY UPDATE: Pro bearer token exposed via apt-helper command line
- Write APT credentials to a temporary 0600 auth file and pass a credential-free URL to apt-helper, instead of embedding the token in the download-file URL argument where it leaked to local users via /proc//cmdline. Source tarball re-packed with the fix (3.0 native).
- cve-2026-9494
- SECURITY UPDATE: APT source injection via crafted contract-server response
- validate contract directives (aptURL, suites, additionalPackages) to reject newline/CR/NUL/space characters, preventing injection of attacker-controlled lines into root-owned apt sources and the apt-get install invocation. Source tarball re-packed with the fix (3.0 native).
- cve-2026-11386
- SECURITY UPDATE: symlink file disclosure in "pro collect-logs"
- Skip symlinked user log files and create the diagnostic archive exclusively (x:gz) with a root-only umask so an existing output file or symlink is not followed or overwritten. Source tarball re-packed with the fix (3.0 native).
- cve-2026-12391
- References