{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2026/cve-2026-5704-els_os-oraclelinux6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-05-04T17:03:58Z",
      "generator": {
        "date": "2026-05-04T17:03:58Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2026-5704-ELS_OS-ORACLELINUX6ELS",
      "initial_release_date": "2026-04-06T16:16:00Z",
      "revision_history": [
        {
          "date": "2026-04-06T16:16:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-27T19:10:12Z",
          "number": "2",
          "summary": "Official Publication"
        },
        {
          "date": "2026-05-04T17:03:58Z",
          "number": "3",
          "summary": "Update document"
        }
      ],
      "status": "final",
      "version": "3"
    },
    "title": "Security update on CVE-2026-5704"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.23-15.el6_8.x86_64",
                "product": {
                  "name": "tar-2:1.23-15.el6_8.x86_64",
                  "product_id": "tar-2:1.23-15.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/tar@1.23-15.el6_8?arch=x86_64&epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 6",
                "product": {
                  "name": "Oracle Linux 6",
                  "product_id": "Oracle-Linux-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.23-15.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "tar-2:1.23-15.el6_8.tuxcare.els1.x86_64",
                  "product_id": "tar-2:1.23-15.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/tuxcare/tar@1.23-15.el6_8.tuxcare.els1?arch=x86_64&epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tar-2:1.23-15.el6_8.tuxcare.els2.x86_64",
                "product": {
                  "name": "tar-2:1.23-15.el6_8.tuxcare.els2.x86_64",
                  "product_id": "tar-2:1.23-15.el6_8.tuxcare.els2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/tar@1.23-15.el6_8.tuxcare.els2?arch=x86_64&epoch=2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.23-15.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:tar-2:1.23-15.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "tar-2:1.23-15.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.23-15.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:tar-2:1.23-15.el6_8.x86_64"
        },
        "product_reference": "tar-2:1.23-15.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tar-2:1.23-15.el6_8.tuxcare.els2.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:tar-2:1.23-15.el6_8.tuxcare.els2.x86_64"
        },
        "product_reference": "tar-2:1.23-15.el6_8.tuxcare.els2.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-5704",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Oracle-Linux-6:tar-2:1.23-15.el6_8.tuxcare.els1.x86_64",
          "Oracle-Linux-6:tar-2:1.23-15.el6_8.tuxcare.els2.x86_64",
          "Oracle-Linux-6:tar-2:1.23-15.el6_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-5704"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2026-5704",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5704"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2455360",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455360"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/11/10",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/11/10"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/11/11",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/11/11"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/12/2",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/12/2"
        }
      ],
      "release_date": "2026-04-06T16:16:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "CVE-2026-5704 requires a local extraction step of an attacker-supplied tarball (user or job must run tar), so there is no remote, unauthenticated trigger. Its impact is limited to creating hidden files within the extraction path under the extractor’s existing privileges, with no confidentiality or availability impact and no inherent code execution or privilege escalation. In centrally administered server/VM environments that do not automatically unpack untrusted archives, practical exposure is minimal, so this can be safely deprioritized.",
          "product_ids": [
            "Oracle-Linux-6:tar-2:1.23-15.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:tar-2:1.23-15.el6_8.tuxcare.els2.x86_64",
            "Oracle-Linux-6:tar-2:1.23-15.el6_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Oracle-Linux-6:tar-2:1.23-15.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:tar-2:1.23-15.el6_8.tuxcare.els2.x86_64",
            "Oracle-Linux-6:tar-2:1.23-15.el6_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}