{
	"document":{
		"aggregate_severity":{
			"namespace":"https://nvd.nist.gov/vuln-metrics/cvss",
			"text":"Medium"
		},
		"category":"csaf_vex",
		"csaf_version":"2.0",
		"distribution":{
			"tlp":{
				"label":"WHITE",
				"url":"https:/www.first.org/tlp/"
			}
		},
		"lang":"en",
		"notes":[
			{
				"text":"patch security update",
				"category":"general",
				"title":"Synopsis"
			},
			{
				"text":"An update for patch is now available for openEuler-24.03-LTS-SP1",
				"category":"general",
				"title":"Summary"
			},
			{
				"text":"Patch takes a patch file containing a difference listing produced by the diff program and applies those differences to one or more original files, producing patched versions.\n\nSecurity Fix(es):\n\nA flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.(CVE-2026-115207)",
				"category":"general",
				"title":"Description"
			},
			{
				"text":"An update for patch is now available for openEuler-24.03-LTS-SP1.\n\nopenEuler Security has rated this update as having a security impact of medium. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.",
				"category":"general",
				"title":"Topic"
			},
			{
				"text":"Medium",
				"category":"general",
				"title":"Severity"
			},
			{
				"text":"patch",
				"category":"general",
				"title":"Affected Component"
			}
		],
		"publisher":{
			"issuing_authority":"openEuler security committee",
			"name":"openEuler",
			"namespace":"https://www.openeuler.org",
			"contact_details":"openeuler-security@openeuler.org",
			"category":"vendor"
		},
		"references":[
			{
				"summary":"openEuler-SA-2026-4618",
				"category":"self",
				"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4618"
			},
			{
				"summary":"CVE-2026-115207",
				"category":"self",
				"url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-115207&packageName=patch"
			},
			{
				"summary":"nvd cve",
				"category":"external",
				"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115207"
			},
			{
				"summary":"openEuler-SA-2026-4618 vex file",
				"category":"self",
				"url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4618.json"
			}
		],
		"title":"An update for patch is now available for openEuler-24.03-LTS-SP1",
		"tracking":{
			"initial_release_date":"2026-10-30T11:13:35+08:00",
			"revision_history":[
				{
					"date":"2026-10-30T11:13:35+08:00",
					"summary":"Initial",
					"number":"1.0.0"
				}
			],
			"generator":{
				"date":"2026-10-30T11:13:35+08:00",
				"engine":{
					"name":"openEuler CSAF Tool V1.0"
				}
			},
			"current_release_date":"2026-10-30T11:13:35+08:00",
			"id":"openEuler-SA-2026-4618",
			"version":"1.0.0",
			"status":"final"
		}
	},
	"product_tree":{
		"branches":[
			{
				"name":"openEuler",
				"category":"vendor",
				"branches":[
					{
						"name":"openEuler",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"openEuler-24.03-LTS-SP1",
									"name":"openEuler-24.03-LTS-SP1"
								},
								"name":"openEuler-24.03-LTS-SP1",
								"category":"product_version"
							}
						],
						"category":"product_name"
					},
					{
						"name":"aarch64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"patch-2.7.6-24.oe2403sp1.aarch64.rpm",
									"name":"patch-2.7.6-24.oe2403sp1.aarch64.rpm"
								},
								"name":"patch-2.7.6-24.oe2403sp1.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"patch-debuginfo-2.7.6-24.oe2403sp1.aarch64.rpm",
									"name":"patch-debuginfo-2.7.6-24.oe2403sp1.aarch64.rpm"
								},
								"name":"patch-debuginfo-2.7.6-24.oe2403sp1.aarch64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"patch-debugsource-2.7.6-24.oe2403sp1.aarch64.rpm",
									"name":"patch-debugsource-2.7.6-24.oe2403sp1.aarch64.rpm"
								},
								"name":"patch-debugsource-2.7.6-24.oe2403sp1.aarch64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"src",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"patch-2.7.6-24.oe2403sp1.src.rpm",
									"name":"patch-2.7.6-24.oe2403sp1.src.rpm"
								},
								"name":"patch-2.7.6-24.oe2403sp1.src.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"x86_64",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"patch-2.7.6-24.oe2403sp1.x86_64.rpm",
									"name":"patch-2.7.6-24.oe2403sp1.x86_64.rpm"
								},
								"name":"patch-2.7.6-24.oe2403sp1.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"patch-debuginfo-2.7.6-24.oe2403sp1.x86_64.rpm",
									"name":"patch-debuginfo-2.7.6-24.oe2403sp1.x86_64.rpm"
								},
								"name":"patch-debuginfo-2.7.6-24.oe2403sp1.x86_64.rpm",
								"category":"product_version"
							},
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"patch-debugsource-2.7.6-24.oe2403sp1.x86_64.rpm",
									"name":"patch-debugsource-2.7.6-24.oe2403sp1.x86_64.rpm"
								},
								"name":"patch-debugsource-2.7.6-24.oe2403sp1.x86_64.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					},
					{
						"name":"noarch",
						"branches":[
							{
								"product":{
									"product_identification_helper":{
										"cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP1"
									},
									"product_id":"patch-help-2.7.6-24.oe2403sp1.noarch.rpm",
									"name":"patch-help-2.7.6-24.oe2403sp1.noarch.rpm"
								},
								"name":"patch-help-2.7.6-24.oe2403sp1.noarch.rpm",
								"category":"product_version"
							}
						],
						"category":"architecture"
					}
				]
			}
		],
		"relationships":[
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"patch-2.7.6-24.oe2403sp1.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.aarch64",
					"name":"patch-2.7.6-24.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"patch-debuginfo-2.7.6-24.oe2403sp1.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:patch-debuginfo-2.7.6-24.oe2403sp1.aarch64",
					"name":"patch-debuginfo-2.7.6-24.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"patch-debugsource-2.7.6-24.oe2403sp1.aarch64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:patch-debugsource-2.7.6-24.oe2403sp1.aarch64",
					"name":"patch-debugsource-2.7.6-24.oe2403sp1.aarch64 as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"patch-2.7.6-24.oe2403sp1.src.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.src",
					"name":"patch-2.7.6-24.oe2403sp1.src as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"patch-2.7.6-24.oe2403sp1.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.x86_64",
					"name":"patch-2.7.6-24.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"patch-debuginfo-2.7.6-24.oe2403sp1.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:patch-debuginfo-2.7.6-24.oe2403sp1.x86_64",
					"name":"patch-debuginfo-2.7.6-24.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"patch-debugsource-2.7.6-24.oe2403sp1.x86_64.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:patch-debugsource-2.7.6-24.oe2403sp1.x86_64",
					"name":"patch-debugsource-2.7.6-24.oe2403sp1.x86_64 as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			},
			{
				"relates_to_product_reference":"openEuler-24.03-LTS-SP1",
				"product_reference":"patch-help-2.7.6-24.oe2403sp1.noarch.rpm",
				"full_product_name":{
					"product_id":"openEuler-24.03-LTS-SP1:patch-help-2.7.6-24.oe2403sp1.noarch",
					"name":"patch-help-2.7.6-24.oe2403sp1.noarch as a component of openEuler-24.03-LTS-SP1"
				},
				"category":"default_component_of"
			}
		]
	},
	"vulnerabilities":[
		{
			"cve":"CVE-2026-115207",
			"notes":[
				{
					"text":"A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.",
					"category":"description",
					"title":"Vulnerability Description"
				}
			],
			"product_status":{
				"fixed":[
					"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.aarch64",
					"openEuler-24.03-LTS-SP1:patch-debuginfo-2.7.6-24.oe2403sp1.aarch64",
					"openEuler-24.03-LTS-SP1:patch-debugsource-2.7.6-24.oe2403sp1.aarch64",
					"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.src",
					"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.x86_64",
					"openEuler-24.03-LTS-SP1:patch-debuginfo-2.7.6-24.oe2403sp1.x86_64",
					"openEuler-24.03-LTS-SP1:patch-debugsource-2.7.6-24.oe2403sp1.x86_64",
					"openEuler-24.03-LTS-SP1:patch-help-2.7.6-24.oe2403sp1.noarch"
				]
			},
			"remediations":[
				{
					"product_ids":[
						"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.aarch64",
						"openEuler-24.03-LTS-SP1:patch-debuginfo-2.7.6-24.oe2403sp1.aarch64",
						"openEuler-24.03-LTS-SP1:patch-debugsource-2.7.6-24.oe2403sp1.aarch64",
						"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.src",
						"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.x86_64",
						"openEuler-24.03-LTS-SP1:patch-debuginfo-2.7.6-24.oe2403sp1.x86_64",
						"openEuler-24.03-LTS-SP1:patch-debugsource-2.7.6-24.oe2403sp1.x86_64",
						"openEuler-24.03-LTS-SP1:patch-help-2.7.6-24.oe2403sp1.noarch"
					],
					"details":"patch security update",
					"category":"vendor_fix",
					"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4618"
				}
			],
			"scores":[
				{
					"cvss_v3":{
						"baseSeverity":"MEDIUM",
						"baseScore":5.5,
						"vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
						"version":"3.1"
					},
					"products":[
						"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.aarch64",
						"openEuler-24.03-LTS-SP1:patch-debuginfo-2.7.6-24.oe2403sp1.aarch64",
						"openEuler-24.03-LTS-SP1:patch-debugsource-2.7.6-24.oe2403sp1.aarch64",
						"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.src",
						"openEuler-24.03-LTS-SP1:patch-2.7.6-24.oe2403sp1.x86_64",
						"openEuler-24.03-LTS-SP1:patch-debuginfo-2.7.6-24.oe2403sp1.x86_64",
						"openEuler-24.03-LTS-SP1:patch-debugsource-2.7.6-24.oe2403sp1.x86_64",
						"openEuler-24.03-LTS-SP1:patch-help-2.7.6-24.oe2403sp1.noarch"
					]
				}
			],
			"threats":[
				{
					"details":"Medium",
					"category":"impact"
				}
			],
			"title":"CVE-2026-115207"
		}
	]
}