OESA-2026-2322

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2322

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-2322.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-2322

Upstream

CVE-2026-28295

Published

2026-05-15T14:01:52Z

Modified

2026-05-15T14:15:15.313310Z

Summary

gvfs security update

Details

Gvfs is a userspace virtual filesystem implementation for GIO (a library available in GLib). It comes with a set of backends, including trash support, SFTP, SMB, HTTP, DAV, and many others. Gvfs also contains modules for GIO that implement volume monitors and persistent metadata storage.

Security Fix(es):

A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.(CVE-2026-28295)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:24.03-LTS-SP1 / gvfs

Package

Name: gvfs
Purl: pkg:rpm/openEuler/gvfs&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.50.2-8.oe2403sp1

Ecosystem specific

{
    "x86_64": [
        "gvfs-1.50.2-8.oe2403sp1.x86_64.rpm",
        "gvfs-client-1.50.2-8.oe2403sp1.x86_64.rpm",
        "gvfs-debuginfo-1.50.2-8.oe2403sp1.x86_64.rpm",
        "gvfs-debugsource-1.50.2-8.oe2403sp1.x86_64.rpm",
        "gvfs-devel-1.50.2-8.oe2403sp1.x86_64.rpm"
    ],
    "src": [
        "gvfs-1.50.2-8.oe2403sp1.src.rpm"
    ],
    "noarch": [
        "gvfs-help-1.50.2-8.oe2403sp1.noarch.rpm"
    ],
    "aarch64": [
        "gvfs-1.50.2-8.oe2403sp1.aarch64.rpm",
        "gvfs-client-1.50.2-8.oe2403sp1.aarch64.rpm",
        "gvfs-debuginfo-1.50.2-8.oe2403sp1.aarch64.rpm",
        "gvfs-debugsource-1.50.2-8.oe2403sp1.aarch64.rpm",
        "gvfs-devel-1.50.2-8.oe2403sp1.aarch64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-2322.json"