| Ticket UUID: | 0b9367a240b66a84d3b6fb7e492eddc17e9ed556 | ||
| Title: | CVE-2026-22184 in zlib/contrib/untgz | ||
| Type: | Bug | Created on: | 2026-01-26 14:46:24 |
| Submitter: | anonymous | Assigned to: | jan.nijtmans |
| Subsystem: | 57. zlib | Severity: | Minor |
| Priority: | 5 Medium | Last modified: | 2026-02-04 11:44:12 |
| Status: | Closed | Closed by: | jan.nijtmans |
| Resolution: | Fixed | Closed on: | 2026-02-04 11:44:12 |
| Version: | 9.0.2 | ||
| Description: | ||||
There is https://access.redhat.com/security/cve/cve-2026-22184. It's a flaw in zlib contrib example code. IMHO the flaw should be fixed or the untgz example dropped. The fix is trivial - zeroing the buffer and using the strncpy instead of the strcpy. Fedora downstream ticket: https://bugzilla.redhat.com/show_bug.cgi?id=2427830 | ||||
| User Comments: | ||||
jan.nijtmans added on 2026-01-26 15:24:32:
The fact that there is a CVE registered, doesn't mean it's a bug. Tcl includes the zlib sourcecode, but the untgz example is not built or used in any way. So this cannot lead to any way this can be mis-used, and lead to an actual security risk. As soon as zlib releases a new version, Tcl will take it over. But in the mean time, there's really nothing to worry about. jan.nijtmans added on 2026-02-04 11:44:12:
It appears that upstream the untgz directory is simply removed completely, so we can do the same. That prevents any possible problem. See: https://github.com/madler/zlib/commit/1a40058a92d525aa49a6eac698cfde500fc9b92f So, let's do the same here. | ||||