{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/cloudlinux7els/vex/2026/cve-2026-105712-els_os-cloudlinux7els.json" } ], "tracking": { "current_release_date": "2026-10-15T17:50:53Z", "generator": { "date": "2026-10-15T17:50:53Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-105712-ELS_OS-CLOUDLINUX7ELS", "initial_release_date": "2026-10-05T18:53:09Z", "revision_history": [ { "date": "2026-10-05T18:53:09Z", "number": "1", "summary": "Initial version" }, { "date": "2026-10-06T12:36:10Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-10-07T09:52:19Z", "number": "3", "summary": "Update document" }, { "date": "2026-10-15T17:50:53Z", "number": "4", "summary": "Update document" } ], "status": "final", "version": "4" }, "title": "Security update on CVE-2026-105712" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudLinux 7", "product": { "name": "CloudLinux 7", "product_id": "CloudLinux-7", "product_identification_helper": { "cpe": "cpe:2.3:o:cloudlinux:cloudlinux:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "CloudLinux" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "gnupg2-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "product": { "name": "gnupg2-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "product_id": "gnupg2-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/gnupg2@2.0.22-5.el7_5.tuxcare.els1?arch=x86_64" } } }, { "category": "product_version", "name": "gnupg2-smime-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "product": { "name": "gnupg2-smime-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "product_id": "gnupg2-smime-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/gnupg2-smime@2.0.22-5.el7_5.tuxcare.els1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "gnupg2-0:2.0.22-5.el7_5.tuxcare.els1.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:gnupg2-0:2.0.22-5.el7_5.tuxcare.els1.x86_64" }, "product_reference": "gnupg2-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "relates_to_product_reference": "CloudLinux-7" }, { "category": "default_component_of", "full_product_name": { "name": "gnupg2-smime-0:2.0.22-5.el7_5.tuxcare.els1.x86_64 as a component of CloudLinux 7", "product_id": "CloudLinux-7:gnupg2-smime-0:2.0.22-5.el7_5.tuxcare.els1.x86_64" }, "product_reference": "gnupg2-smime-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "relates_to_product_reference": "CloudLinux-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-105712", "notes": [ { "category": "description", "text": "gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk.", "title": "Vulnerability description" }, { "category": "other", "text": "TuxCare has assessed that this vulnerability does not impact any currently supported TuxCare products. This evaluation may change as new information becomes available. For additional details regarding this vulnerability and affected products, refer to the provided references.", "title": "Statement" } ], "product_status": { "known_not_affected": [ "CloudLinux-7:gnupg2-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "CloudLinux-7:gnupg2-smime-0:2.0.22-5.el7_5.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-105712" }, { "category": "external", "summary": "https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88", "url": "https://github.com/gpg/gnupg/commit/7a2692fe5e580ae3bbb2a47abc4baaf1af65aa88" }, { "category": "external", "summary": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html", "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000504.html" }, { "category": "external", "summary": "https://static.dev.gnupg.org/T8159.html", "url": "https://static.dev.gnupg.org/T8159.html" } ], "release_date": "2026-10-05T18:53:09Z", "threats": [ { "category": "impact", "details": "Moderate" }, { "category": "impact", "date": "2026-10-15T15:22:21.187503Z", "details": "The gnupg2 package for CloudLinux 7 ELS is not affected by CVE-2026-105712. The gpgtar tool is not enabled in this build and no gpgtar binary is shipped, so the vulnerable archive-extraction code is not compiled into the package.", "product_ids": [ "CloudLinux-7:gnupg2-0:2.0.22-5.el7_5.tuxcare.els1.x86_64", "CloudLinux-7:gnupg2-smime-0:2.0.22-5.el7_5.tuxcare.els1.x86_64" ] } ] } ] }