It was discovered that ruby-mixlib-archive, a Chef Software's library used to handle various archive formats, was vulnerable to a directory traversal attack. This allowed attackers to overwrite arbitrary files by using a malicious tar archive containing ".." in its entries.
We don't seem to have that software.
CC: (none) => marja11Status: NEW => RESOLVEDResolution: (none) => INVALID
Then consider it a Package Request.
Component: RPM Packages => New RPM package requestStatus: RESOLVED => REOPENEDResolution: INVALID => (none)
Hi Zombie, Please read https://wiki.mageia.org/en/How_to_report_a_bug_properly#How_to_file_a_package_request and adjust this report accordingly. (Obsoleting the description and comment #1, since they are now unrelated)
Summary: ruby-mixlib-archive security vulnerability CVE-2017-1000026 => ruby-mixlib-archive, <replace this with a short summary of the program's purpose>URL: https://www.debian.org/security/2017/dsa-3915 => (none)
A piece of software *having* a security vulnerability is not a reason to import it. This is the second time. Please stop this.
Status: REOPENED => RESOLVEDResolution: (none) => INVALIDComponent: New RPM package request => Security