{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-75598-els_os-oraclelinux6els.json" } ], "tracking": { "current_release_date": "2026-11-09T12:38:45Z", "generator": { "date": "2026-11-09T12:38:45Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2026-75598-ELS_OS-ORACLELINUX6ELS", "initial_release_date": "2026-11-06T17:51:29Z", "revision_history": [ { "date": "2026-11-06T17:51:29Z", "number": "1", "summary": "Initial version" }, { "date": "2026-11-07T12:53:09Z", "number": "2", "summary": "Official Publication" }, { "date": "2026-11-08T12:41:01Z", "number": "3", "summary": "Update document" }, { "date": "2026-11-09T12:38:45Z", "number": "4", "summary": "Update document" } ], "status": "final", "version": "4" }, "title": "Security update on CVE-2026-75598" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Oracle Linux 6", "product": { "name": "Oracle Linux 6", "product_id": "Oracle-Linux-6", "product_identification_helper": { "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Oracle Linux" }, { "branches": [ { "category": "product_version", "name": "shadow-utils-2:4.1.5.1-5.el6.x86_64", "product": { "name": "shadow-utils-2:4.1.5.1-5.el6.x86_64", "product_id": "shadow-utils-2:4.1.5.1-5.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/oracle/shadow-utils@4.1.5.1-5.el6?arch=x86_64&epoch=2" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Oracle Corporation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "shadow-utils-2:4.1.5.1-5.el6.tuxcare.els1.x86_64", "product": { "name": "shadow-utils-2:4.1.5.1-5.el6.tuxcare.els1.x86_64", "product_id": "shadow-utils-2:4.1.5.1-5.el6.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/cloudlinux/shadow-utils@4.1.5.1-5.el6.tuxcare.els1?arch=x86_64&epoch=2" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "shadow-utils-2:4.1.5.1-5.el6.tuxcare.els1.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:shadow-utils-2:4.1.5.1-5.el6.tuxcare.els1.x86_64" }, "product_reference": "shadow-utils-2:4.1.5.1-5.el6.tuxcare.els1.x86_64", "relates_to_product_reference": "Oracle-Linux-6" }, { "category": "default_component_of", "full_product_name": { "name": "shadow-utils-2:4.1.5.1-5.el6.x86_64 as a component of Oracle Linux 6", "product_id": "Oracle-Linux-6:shadow-utils-2:4.1.5.1-5.el6.x86_64" }, "product_reference": "shadow-utils-2:4.1.5.1-5.el6.x86_64", "relates_to_product_reference": "Oracle-Linux-6" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-75598", "notes": [ { "category": "description", "text": "The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0.", "title": "Vulnerability description" } ], "product_status": { "known_affected": [ "Oracle-Linux-6:shadow-utils-2:4.1.5.1-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:shadow-utils-2:4.1.5.1-5.el6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2026-75598" }, { "category": "external", "summary": "https://github.com/GradleUp/shadow/commit/0c2744fcc050e34a084f5131d5e167b13c342bfd", "url": "https://github.com/GradleUp/shadow/commit/0c2744fcc050e34a084f5131d5e167b13c342bfd" }, { "category": "external", "summary": "https://github.com/GradleUp/shadow/releases/tag/9.6.0", "url": "https://github.com/GradleUp/shadow/releases/tag/9.6.0" }, { "category": "external", "summary": "https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986", "url": "https://github.com/GradleUp/shadow/security/advisories/GHSA-rr8v-fxxf-c986" } ], "release_date": "2026-11-06T17:51:29Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-11-09T10:15:08.524888Z", "details": "This flaw affects the Shadow Gradle plugin at build time: it requires a malicious dependency to be incorporated and a developer/CI run of shadowJar, and any impact only materializes if a downstream tool later extracts the produced JAR without path traversal protections. In enterprise server/VM deployments, uber JARs are executed directly by the JVM rather than unpacked during normal operation, so there is no runtime exposure or remote attack surface. The vulnerability impacts integrity only (file overwrite on unsafe extraction) with no confidentiality or availability effect, making it a low-priority hardening update for build pipelines rather than an urgent production fix.", "product_ids": [ "Oracle-Linux-6:shadow-utils-2:4.1.5.1-5.el6.tuxcare.els1.x86_64", "Oracle-Linux-6:shadow-utils-2:4.1.5.1-5.el6.x86_64" ] } ] } ] }