RHSA-2026:98585: Important: lrzsz security update
Lrzsz (consisting of lrz and lsz) is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems.Security Fix(es): lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840) lrzsz: lrzsz: Arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/lrzszto a version that resolves this vulnerability.Fixed in 0.12.20-68.el10_3 - Upgrade
Upgrade
redhat/lrzsz-debuginfoto a version that resolves this vulnerability.Fixed in 0.12.20-68.el10_3 - Upgrade
Upgrade
redhat/lrzsz-debugsourceto a version that resolves this vulnerability.Fixed in 0.12.20-68.el10_3 - Upgrade
Upgrade
redhat/lrzszto a version that resolves this vulnerability.Fixed in 0.12.20-68.el10_3.aa - Upgrade
Upgrade
redhat/lrzsz-debuginfoto a version that resolves this vulnerability.Fixed in 0.12.20-68.el10_3.aa - Upgrade
Upgrade
redhat/lrzsz-debugsourceto a version that resolves this vulnerability.Fixed in 0.12.20-68.el10_3.aa