RHSA-2026:72399
Vulnerability from csaf_redhat - Published: 2026-09-28 07:22 - Updated: 2026-09-28 14:11Summary
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1
Severity
Important
Notes
Topic: cert-manager Operator for Red Hat OpenShift 1.20.1
Details: The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities
and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide
certificates-as-a-service to developers working within your Kubernetes cluster.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.
CWE-121 - Stack-based Buffer OverflowAffected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.
6.8 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.
5.7 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in glibc, the GNU C Library. Specifically, deprecated functions responsible for printing TSIG (Transaction Signature) records fail to properly manage memory buffers. This oversight can lead to an out-of-bounds write when processing specially crafted TSIG records. An attacker could exploit this to cause a denial of service or potentially execute arbitrary code.
5.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in glibc (GNU C Library). When the `ungetwc` function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensitive information from memory or cause the program to crash, resulting in a denial of service.
5.0 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in glibc (GNU C Library). The deprecated functions ns_printrrf, ns_printrr, and fp_nquery do not properly validate the length of RDATA (Resource Record Data) in a DNS (Domain Name System) response when processing specific record types like LOC, CERT, TKEY, or TSIG. A remote attacker could craft a malicious DNS response, leading to a target application crashing or reading uninitialized memory. These functions are intended for application debugging and are not part of the standard DNS resolver path.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.
5.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentially exposing sensitive authentication information to an unauthorized entity. This is an information disclosure vulnerability.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.
4.8 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.
6.2 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in OpenSSL. In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, where only the private key (with no certificate) is configured, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted "signature_algorithms_cert" TLS extension. This issue results in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Low
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.
5.3 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
7.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.
7.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in `acl`. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invoke `getfacl` or `setfacl` over an attacker-controlled path, potentially leading to local privilege escalation.
6.3 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in the `attr` package. This vulnerability allows a local attacker to perform a symlink traversal attack by replacing a pathname component with a symbolic link - either during directory hierarchy traversal by `getfattr` or during backup restoration by `setfattr`, which reads and resolves full pathnames from backup files. In both cases, when these utilities are executed by a privileged process over a path controlled by the attacker, this can lead to local privilege escalation.
6.3 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in OpenSSL. Receiving a DTLS (Datagram Transport Layer Security) record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a small amount of network traffic.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Low
A flaw was found in GNU coreutils, specifically in the `unexpand` utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when `unexpand` processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing subsequent operations to write beyond its boundaries. Successful exploitation can cause the `unexpand` utility to crash, potentially resulting in a denial of service or enabling further memory manipulation.
4.4 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security relevant authorization decisions, an attacker with a valid key could bypass network-based access controls to gain additional privileges.
6.8 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
7.3 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
5.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections.
5.4 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in OpenSSL. A malicious CMP (Certificate Management Protocol) endpoint can send an unexpected distinguished name (DN) directly as the format string argument to ERR_raise_data(), causing the application to dereference and write to unrelated stack contents. This can lead to a crash in the CMP client, resulting in a denial of service.
5.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Low
A flaw was found in OpenSSL. The CMP (Certificate Management Protocol) implementation does not clear cached additional certificates when an invalid message is received, leading to excessive memory consumption. This allows a malicious client to repeatedly send requests containing unique extra certificates to cause memory exhaustion, eventually resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Low
A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory exhaustion, eventually resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Low
A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP (Hypertext Transfer Protocol) trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers, causing an upstream proxy and the Libevent application to interpret different effective headers. This can lead to header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the `evbuffer_add_buffer_reference` function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or crash the application.
6.6 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Moderate
A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successful exploitation could lead to request smuggling, potentially bypassing access controls or poisoning caches.
7.7 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the `decode_tag_internal()` function by sending specially crafted, attacker-controlled tagged RPC (Remote Procedure Call) data. This could lead to a denial of service, causing the process that decodes the data to crash.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in Libevent. An incorrect integer conversion in the `evtag_unmarshal_header` function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in libevent. The evhttp_decode_uri_internal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes /admin/secret, bypassing path-based access controls. Additionally, evhttp_header_is_valid_value accepts obsolete HTTP header line folding (CRLF followed by SP/HT), which RFC 9112 states new implementations should reject, creating a header injection vector in proxy chains where the frontend rejects obs-fold but libevent accepts it. This could lead to access control bypass, header injection, or request smuggling.
7.7 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the `dnsname_to_labels` function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the process, resulting in a denial of service or potential information disclosure and integrity impact.
8.6 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the `bufferevent_socket_set_conn_address_` function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AF_UNIX listener, an attacker can overwrite critical heap data, leading to memory corruption and potentially full control over the affected system. This can severely impact the confidentiality, integrity, and availability of data and services.
8.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-6170
Threats
Impact
Important
References
372 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "cert-manager Operator for Red Hat OpenShift 1.20.1",
"title": "Topic"
},
{
"category": "general",
"text": "The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities\nand certificates as first-class resource types in the Kubernetes API. This makes it possible to provide\ncertificates-as-a-service to developers working within your Kubernetes cluster.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:72399",
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-6170",
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11822",
"url": "https://access.redhat.com/security/cve/CVE-2026-11822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11824",
"url": "https://access.redhat.com/security/cve/CVE-2026-11824"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11979",
"url": "https://access.redhat.com/security/cve/CVE-2026-11979"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13757",
"url": "https://access.redhat.com/security/cve/CVE-2026-13757"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14164",
"url": "https://access.redhat.com/security/cve/CVE-2026-14164"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14456",
"url": "https://access.redhat.com/security/cve/CVE-2026-14456"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14457",
"url": "https://access.redhat.com/security/cve/CVE-2026-14457"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15588",
"url": "https://access.redhat.com/security/cve/CVE-2026-15588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-16118",
"url": "https://access.redhat.com/security/cve/CVE-2026-16118"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18798",
"url": "https://access.redhat.com/security/cve/CVE-2026-18798"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1965",
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-3783",
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41989",
"url": "https://access.redhat.com/security/cve/CVE-2026-41989"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46600",
"url": "https://access.redhat.com/security/cve/CVE-2026-46600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48864",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5435",
"url": "https://access.redhat.com/security/cve/CVE-2026-5435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54369",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54370",
"url": "https://access.redhat.com/security/cve/CVE-2026-54370"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54371",
"url": "https://access.redhat.com/security/cve/CVE-2026-54371"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54874",
"url": "https://access.redhat.com/security/cve/CVE-2026-54874"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56392",
"url": "https://access.redhat.com/security/cve/CVE-2026-56392"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56854",
"url": "https://access.redhat.com/security/cve/CVE-2026-56854"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58010",
"url": "https://access.redhat.com/security/cve/CVE-2026-58010"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58011",
"url": "https://access.redhat.com/security/cve/CVE-2026-58011"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58012",
"url": "https://access.redhat.com/security/cve/CVE-2026-58012"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58013",
"url": "https://access.redhat.com/security/cve/CVE-2026-58013"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58014",
"url": "https://access.redhat.com/security/cve/CVE-2026-58014"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58015",
"url": "https://access.redhat.com/security/cve/CVE-2026-58015"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58016",
"url": "https://access.redhat.com/security/cve/CVE-2026-58016"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58055",
"url": "https://access.redhat.com/security/cve/CVE-2026-58055"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5928",
"url": "https://access.redhat.com/security/cve/CVE-2026-5928"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6238",
"url": "https://access.redhat.com/security/cve/CVE-2026-6238"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63072",
"url": "https://access.redhat.com/security/cve/CVE-2026-63072"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63073",
"url": "https://access.redhat.com/security/cve/CVE-2026-63073"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63074",
"url": "https://access.redhat.com/security/cve/CVE-2026-63074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63075",
"url": "https://access.redhat.com/security/cve/CVE-2026-63075"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63076",
"url": "https://access.redhat.com/security/cve/CVE-2026-63076"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63379",
"url": "https://access.redhat.com/security/cve/CVE-2026-63379"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63381",
"url": "https://access.redhat.com/security/cve/CVE-2026-63381"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63382",
"url": "https://access.redhat.com/security/cve/CVE-2026-63382"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63383",
"url": "https://access.redhat.com/security/cve/CVE-2026-63383"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63384",
"url": "https://access.redhat.com/security/cve/CVE-2026-63384"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63385",
"url": "https://access.redhat.com/security/cve/CVE-2026-63385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63387",
"url": "https://access.redhat.com/security/cve/CVE-2026-63387"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-63388",
"url": "https://access.redhat.com/security/cve/CVE-2026-63388"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6653",
"url": "https://access.redhat.com/security/cve/CVE-2026-6653"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8286",
"url": "https://access.redhat.com/security/cve/CVE-2026-8286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84445",
"url": "https://access.redhat.com/security/cve/CVE-2026-84445"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8458",
"url": "https://access.redhat.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-8927",
"url": "https://access.redhat.com/security/cve/CVE-2026-8927"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-9547",
"url": "https://access.redhat.com/security/cve/CVE-2026-9547"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html",
"url": "https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_72399.json"
}
],
"title": "Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1",
"tracking": {
"current_release_date": "2026-09-28T14:11:40+00:00",
"generator": {
"date": "2026-09-28T14:11:40+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:72399",
"initial_release_date": "2026-09-28T07:22:50+00:00",
"revision_history": [
{
"date": "2026-09-28T07:22:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-28T07:22:53+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-28T14:11:40+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Cert Manager support for Red Hat OpenShift release 1.20",
"product": {
"name": "Cert Manager support for Red Hat OpenShift release 1.20",
"product_id": "Cert Manager support for Red Hat OpenShift release 1.20",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:cert_manager:1.20::el9"
}
}
}
],
"category": "product_family",
"name": "Cert Manager support for Red Hat OpenShift release"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"product": {
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"product_id": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cert-manager-operator-rhel9@sha256%3A4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f?arch=amd64\u0026repository_url=registry.redhat.io/cert-manager/cert-manager-operator-rhel9\u0026tag=1790272426"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64",
"product": {
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64",
"product_id": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cert-manager-operator-rhel9@sha256%3Ada5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755?arch=arm64\u0026repository_url=registry.redhat.io/cert-manager/cert-manager-operator-rhel9\u0026tag=1790272426"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"product": {
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"product_id": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cert-manager-operator-rhel9@sha256%3A45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2?arch=ppc64le\u0026repository_url=registry.redhat.io/cert-manager/cert-manager-operator-rhel9\u0026tag=1790272426"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"product": {
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"product_id": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cert-manager-operator-rhel9@sha256%3A0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca?arch=s390x\u0026repository_url=registry.redhat.io/cert-manager/cert-manager-operator-rhel9\u0026tag=1790272426"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x as a component of Cert Manager support for Red Hat OpenShift release 1.20",
"product_id": "Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x"
},
"product_reference": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"relates_to_product_reference": "Cert Manager support for Red Hat OpenShift release 1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64 as a component of Cert Manager support for Red Hat OpenShift release 1.20",
"product_id": "Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64"
},
"product_reference": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"relates_to_product_reference": "Cert Manager support for Red Hat OpenShift release 1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.20",
"product_id": "Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le"
},
"product_reference": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"relates_to_product_reference": "Cert Manager support for Red Hat OpenShift release 1.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64 as a component of Cert Manager support for Red Hat OpenShift release 1.20",
"product_id": "Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
},
"product_reference": "registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64",
"relates_to_product_reference": "Cert Manager support for Red Hat OpenShift release 1.20"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ahmed Lekssays"
]
}
],
"cve": "CVE-2025-6170",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2025-06-16T05:33:22.955000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2372952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has rated the severity of this vulnerability as Low, since it affects only the interactive shell mode of the xmllint tool and requires a user to manually run the tool and enter or receive specially crafted input. The exploitation requires local access and a highly specific usage scenario that is uncommon in typical environments. While it can cause a crash, the impact is limited to availability, and exploitation is unlikely in real-world deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"category": "external",
"summary": "RHBZ#2372952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-6170",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
}
],
"release_date": "2025-06-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly recommended to apply the upstream patch once available.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling"
},
{
"cve": "CVE-2026-1965",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-03-11T11:00:54.752485+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"category": "external",
"summary": "RHBZ#2446448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-1965.html",
"url": "https://curl.se/docs/CVE-2026-1965.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-1965.json",
"url": "https://curl.se/docs/CVE-2026-1965.json"
}
],
"release_date": "2026-03-11T10:08:52.431000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication"
},
{
"cve": "CVE-2026-3783",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-03-11T11:01:01.429907+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"category": "external",
"summary": "RHBZ#2446450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3783",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/03/11/2",
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3783.html",
"url": "https://curl.se/docs/CVE-2026-3783.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-3783.json",
"url": "https://curl.se/docs/CVE-2026-3783.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3583983",
"url": "https://hackerone.com/reports/3583983"
}
],
"release_date": "2026-03-11T10:09:08.746000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect"
},
{
"cve": "CVE-2026-5435",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-04-28T14:01:44.684432+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463465"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc, the GNU C Library. Specifically, deprecated functions responsible for printing TSIG (Transaction Signature) records fail to properly manage memory buffers. This oversight can lead to an out-of-bounds write when processing specially crafted TSIG records. An attacker could exploit this to cause a denial of service or potentially execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Out-of-bounds write via TSIG record processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5435"
},
{
"category": "external",
"summary": "RHBZ#2463465",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463465"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5435"
},
{
"category": "external",
"summary": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u",
"url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=34033",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34033"
}
],
"release_date": "2026-04-28T11:58:54.962000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Out-of-bounds write via TSIG record processing"
},
{
"cve": "CVE-2026-5928",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-20T21:01:38.811304+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2459854"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc (GNU C Library). When the `ungetwc` function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensitive information from memory or cause the program to crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5928"
},
{
"category": "external",
"summary": "RHBZ#2459854",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459854"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5928"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5928",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5928"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33998",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33998"
}
],
"release_date": "2026-04-20T20:37:31.743000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings"
},
{
"cve": "CVE-2026-6238",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-04-28T19:09:30.721026+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc (GNU C Library). The deprecated functions ns_printrrf, ns_printrr, and fp_nquery do not properly validate the length of RDATA (Resource Record Data) in a DNS (Domain Name System) response when processing specific record types like LOC, CERT, TKEY, or TSIG. A remote attacker could craft a malicious DNS response, leading to a target application crashing or reading uninitialized memory. These functions are intended for application debugging and are not part of the standard DNS resolver path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6238"
},
{
"category": "external",
"summary": "RHBZ#2463539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6238"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6238",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6238"
},
{
"category": "external",
"summary": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u",
"url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=34069",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34069"
}
],
"release_date": "2026-04-28T16:43:08.526000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response"
},
{
"cve": "CVE-2026-6653",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-06-22T14:01:42.248415+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491354"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the `xmlParseInternalSubset` function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact use-after-free vulnerability in libxml2 can lead to a denial of service in Red Hat products that process untrusted XML input. In the worst-case scenario, a remote attacker is able to provide specially crafted XML, which, if parsed by an affected application, could cause the application to crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6653"
},
{
"category": "external",
"summary": "RHBZ#2491354",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491354"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6653",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6653"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6653"
},
{
"category": "external",
"summary": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260",
"url": "https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058"
}
],
"release_date": "2026-06-22T12:40:31.424000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\nUpdating to a fixed version of libxml2 (2.11.0 or later upstream, or a future RHEL errata) will fully resolve this issue.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free"
},
{
"cve": "CVE-2026-8286",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-07-03T07:01:27.043110+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496763"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When a new data transfer attempts to upgrade its connection using STARTTLS, it may incorrectly reuse an existing live connection. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Insecure connection establishment due to TLS configuration mismatch",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8286"
},
{
"category": "external",
"summary": "RHBZ#2496763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496763"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8286"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8286.html",
"url": "https://curl.se/docs/CVE-2026-8286.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8286.json",
"url": "https://curl.se/docs/CVE-2026-8286.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3718195",
"url": "https://hackerone.com/reports/3718195"
}
],
"release_date": "2026-07-03T06:14:17.541000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: Insecure connection establishment due to TLS configuration mismatch"
},
{
"cve": "CVE-2026-8458",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-07-03T07:01:30.042181+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496764"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Unauthorized connection reuse due to a logical error",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in libcurl where a logical error in connection pooling can lead to unauthorized connection reuse. When an application uses Negotiate authentication with different service names on the same hostname and port, libcurl might incorrectly reuse an existing authenticated connection for an unintended service. This could result in information disclosure or unauthorized access to resources, bypassing intended service isolation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "RHBZ#2496764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496764"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8458.html",
"url": "https://curl.se/docs/CVE-2026-8458.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8458.json",
"url": "https://curl.se/docs/CVE-2026-8458.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3721183",
"url": "https://hackerone.com/reports/3721183"
}
],
"release_date": "2026-07-03T06:14:42.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: libcurl: Unauthorized connection reuse due to a logical error"
},
{
"cve": "CVE-2026-8927",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-03T07:01:44.730187+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496769"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the library does not properly clear the proxy authentication state. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentially exposing sensitive authentication information to an unauthorized entity. This is an information disclosure vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: Information disclosure due to uncleared proxy authentication state",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure vulnerability in libcurl arises when a handle is reused for sequential transfers with environment-variable proxy configurations, failing to clear the proxy authentication state. This oversight can lead to `Proxy-Authorization` headers being inadvertently sent to an incorrect proxy, potentially exposing sensitive authentication information in Red Hat environments utilizing multiple proxy configurations. This flaw leads only to a confidentiality impact. There has been no observed integrity impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8927"
},
{
"category": "external",
"summary": "RHBZ#2496769",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496769"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8927",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8927"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8927",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8927"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8927.html",
"url": "https://curl.se/docs/CVE-2026-8927.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8927.json",
"url": "https://curl.se/docs/CVE-2026-8927.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3744543",
"url": "https://hackerone.com/reports/3744543"
}
],
"release_date": "2026-07-03T06:16:06.376000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications utilizing libcurl should avoid reusing handles when switching between different proxy configurations. This operational control prevents the unintended leakage of `Proxy-Authorization` headers to incorrect proxies.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: Information disclosure due to uncleared proxy authentication state"
},
{
"cve": "CVE-2026-9547",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-07-03T07:01:12.182841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496758"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server\u0027s host key type differs from the one stored in the known_hosts file. The callback mechanism fails to enforce the host key restriction, enabling a connection to an untrusted server and risking a man-in-the-middle attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Man-in-the-middle attack via SSH host key bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where libcurl-based applications performing SCP or SFTP transfers with the CURLOPT_SSH_KEYFUNCTION callback may silently accept an untrusted server. This occurs when a server presents a host key type that differs from the one recorded in the known_hosts file, bypassing a critical host key verification and enabling potential man-in-the-middle attacks. The vulnerability requires specific application callback usage, not a general curl client default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9547"
},
{
"category": "external",
"summary": "RHBZ#2496758",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496758"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9547"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9547"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9547.html",
"url": "https://curl.se/docs/CVE-2026-9547.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-9547.json",
"url": "https://curl.se/docs/CVE-2026-9547.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3751712",
"url": "https://hackerone.com/reports/3751712"
}
],
"release_date": "2026-07-03T06:18:44.499000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: curl: Man-in-the-middle attack via SSH host key bypass"
},
{
"cve": "CVE-2026-11822",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-09T20:01:15.006955+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487258"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite\u0027s FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the SQLite FTS5 full-text search extension can lead to arbitrary code execution or denial of service. Exploitation requires an application to process a specially crafted SQLite database containing malformed FTS5 page data, which could occur if an attacker provides a malicious database to a vulnerable application. This risk is elevated in scenarios where applications handle untrusted SQLite database files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11822"
},
{
"category": "external",
"summary": "RHBZ#2487258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension",
"url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension"
}
],
"release_date": "2026-06-09T19:08:31.019000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
},
{
"cve": "CVE-2026-11824",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-09T20:02:19.874232+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487269"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11824"
},
{
"category": "external",
"summary": "RHBZ#2487269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
"url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
}
],
"release_date": "2026-06-09T19:21:42.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
},
{
"cve": "CVE-2026-11979",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-06-29T14:01:11.961973+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494191"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in libxml2 affects the `xmlcatalog` utility when operating in `--shell` mode. Exploitation requires an attacker to provide specially crafted, excessively long input, leading to stack-based buffer overflows. This vulnerability is limited to scenarios where an attacker can control input to the `xmlcatalog` utility, reducing its overall exposure in typical Red Hat deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11979"
},
{
"category": "external",
"summary": "RHBZ#2494191",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494191"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11979",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11979"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11979"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/06/CVE-2026-11979",
"url": "https://cert.pl/en/posts/2026/06/CVE-2026-11979"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e"
}
],
"release_date": "2026-06-29T13:21:42.697000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow"
},
{
"cve": "CVE-2026-13757",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-06-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494556"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13757"
},
{
"category": "external",
"summary": "RHBZ#2494556",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494556"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13757",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13757"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13757",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13757"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-p2wm-69qx-x25w",
"url": "https://github.com/advisories/GHSA-p2wm-69qx-x25w"
}
],
"release_date": "2026-06-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/\u003cuid\u003e/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication.\n\nIf p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention.\n\nRed Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing"
},
{
"cve": "CVE-2026-14164",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2493411"
}
],
"notes": [
{
"category": "description",
"text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14164"
},
{
"category": "external",
"summary": "RHBZ#2493411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/issues/3069",
"url": "https://github.com/libarchive/libarchive/issues/3069"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/3071",
"url": "https://github.com/libarchive/libarchive/pull/3071"
}
],
"release_date": "2026-05-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
},
{
"cve": "CVE-2026-14456",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T14:21:24.109249+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515348"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 9.8+, 10.2+, Red Hat Hardened Images, RHIVOS 2, and OpenShift 4.22 ship OpenSSL 3.5.x which includes the QUIC server implementation affected by this flaw. Earlier RHEL versions ship OpenSSL 3.2.x or below, which do not include the QUIC server feature and are not affected. The FIPS module is not affected as the QUIC implementation is outside the OpenSSL FIPS module boundary. Applications must explicitly enable the QUIC server listener to be vulnerable; simply having OpenSSL 3.5 installed does not expose the flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14456"
},
{
"category": "external",
"summary": "RHBZ#2515348",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515348"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
"url": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
"url": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
"url": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260813.txt",
"url": "https://openssl-library.org/news/secadv/20260813.txt"
}
],
"release_date": "2026-08-13T13:55:52.370000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.]\n\nA. Confirm QUIC Exposure - Check if any service is listening on UDP 443:\n~~~\n$ ss -ulnp | grep \u0027:443\u0027\n# or\n$ sudo lsof -iUDP:443 -n -P\n~~~\n\nNote: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected).\n\nB. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:)\n~~~\n$ sudo firewall-cmd --permanent --remove-service=quic 2\u003e/dev/null\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"10.0.0.0/8\" port port=\"443\" protocol=\"udp\" accept\u0027\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" port port=\"443\" protocol=\"udp\" drop\u0027\n$ sudo firewall-cmd --reload\n~~~\n\nC. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled):\n~~~\n$ nc -u -v YOUR_HOST 443\n~~~\n\nOption 2: Disable QUIC Server\n\nIf QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead.\n\nRecommended Mitigation Priority\nPriority : Action\n1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range\n2.Block or rate-limit UDP 443 at firewall/edge (immediate)\n3.Disable QUIC/HTTP3 on the service if not needed\n4.Upgrade OpenSSL to fixed release when available\n5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server"
},
{
"cve": "CVE-2026-14457",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-08-17T19:33:23.332000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517562"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. In a server or client configuration with RFC7250 Raw Public Keys (RPKs) enabled, where only the private key (with no certificate) is configured, a NULL pointer dereference may occur when the remote peer solicits raw public keys and also sends the typically omitted \"signature_algorithms_cert\" TLS extension. This issue results in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: RPK server signature algorithm selection can dereference a missing certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Server or client configurations with RPKs (RFC7250 Raw Public Keys) enabled, where only the private key (with no associated certificate) is configured, are vulnerable to this issue. However, key-only RPK configurations are not considered a best practice, limiting the exposure of this flaw. This issue can cause a NULL pointer dereference, resulting in a denial of service due to an application abort. There is no data disclosure or command execution. For these reasons, this vulnerability has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14457"
},
{
"category": "external",
"summary": "RHBZ#2517562",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517562"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14457"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14457",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14457"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: RPK server signature algorithm selection can dereference a missing certificate"
},
{
"acknowledgments": [
{
"names": [
"Gitee Codepecker Lab"
]
}
],
"cve": "CVE-2026-15588",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499675"
}
],
"notes": [
{
"category": "description",
"text": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the `GDBus` component of GLib. A local or remote unauthenticated attacker could send an engineered stream of data without line length limitations during the authentication process (`gdbusauth`), leading to excessive memory allocation and CPU consumption. This resource exhaustion can result in a denial-of-service (DoS) condition, causing applications or services dependent on GLib to become unstable or crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15588"
},
{
"category": "external",
"summary": "RHBZ#2499675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985"
}
],
"release_date": "2026-07-12T10:10:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering"
},
{
"acknowledgments": [
{
"names": [
"asotyc"
]
}
],
"cve": "CVE-2026-16118",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-07-17T13:20:23.862000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2501732"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker must convince a user to install a malicious MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) and process it with an application performing MIME type detection, limiting its exposure. Also, only little-endian systems are vulnerable. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16118"
},
{
"category": "external",
"summary": "RHBZ#2501732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501732"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118"
},
{
"category": "external",
"summary": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41",
"url": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41"
}
],
"release_date": "2026-07-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Do not install a MIME magic file or content from untrusted sources.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c"
},
{
"cve": "CVE-2026-18798",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-08-17T19:14:03.992000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517559"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: QUIC server may trigger double free when processing INITIAL packet",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can cause memory corruption due to the double free of the QRX object. However, there is currently no evidence it allows remote code execution, limiting the impact of this vulnerability to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18798"
},
{
"category": "external",
"summary": "RHBZ#2517559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517559"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18798"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18798",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18798"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: QUIC server may trigger double free when processing INITIAL packet"
},
{
"cve": "CVE-2026-41989",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-23T05:00:56.113348+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461063"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41989"
},
{
"category": "external",
"summary": "RHBZ#2461063",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461063"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989"
},
{
"category": "external",
"summary": "https://dev.gnupg.org/T8211",
"url": "https://dev.gnupg.org/T8211"
},
{
"category": "external",
"summary": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html",
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/21/1",
"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
}
],
"release_date": "2026-04-23T04:30:26.124000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext"
},
{
"cve": "CVE-2026-46600",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-07-21T20:01:59.038876+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504234"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/dns/dnsmessage. A remote attacker could send a specially crafted Service Binding (SVCB) or HTTPS resource record (RR) to a system using this component. When parsing this invalid record, the system may panic due to a parameter value overflowing the message buffer. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46600"
},
{
"category": "external",
"summary": "RHBZ#2504234",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504234"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46600"
},
{
"category": "external",
"summary": "https://go.dev/cl/786345",
"url": "https://go.dev/cl/786345"
},
{
"category": "external",
"summary": "https://go.dev/issue/79795",
"url": "https://go.dev/issue/79795"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5942",
"url": "https://pkg.go.dev/vuln/GO-2026-5942"
}
],
"release_date": "2026-07-21T19:18:59.755000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-48864",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-21T23:19:41+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This heap buffer overflow in libsolv\u0027s page decompression logic can lead to out-of-bounds reads and writes when processing specially crafted `.solv` files. Exploitation requires a victim application to ingest malicious repository metadata, limiting the attack vector to scenarios involving user interaction or untrusted content sources. Given the user interaction needed, Red Hat Product Security has rated this vulnerability as having a impact of Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "RHBZ#2460425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864"
}
],
"release_date": "2026-05-26T16:07:55.363000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54369",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-06-16T23:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490277"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acl: Symlink traversal privilege escalation via libacl functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "RHBZ#2490277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "acl: Symlink traversal privilege escalation via libacl functions"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54370",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-06-16T19:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490279"
}
],
"notes": [
{
"category": "description",
"text": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in `acl`. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invoke `getfacl` or `setfacl` over an attacker-controlled path, potentially leading to local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acl: TOCTOU Symlink Traversal via getfacl/setfacl",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54370"
},
{
"category": "external",
"summary": "RHBZ#2490279",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490279"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54370"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54370",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54370"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "acl: TOCTOU Symlink Traversal via getfacl/setfacl"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54371",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-06-16T23:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490283"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `attr` package. This vulnerability allows a local attacker to perform a symlink traversal attack by replacing a pathname component with a symbolic link - either during directory hierarchy traversal by `getfattr` or during backup restoration by `setfattr`, which reads and resolves full pathnames from backup files. In both cases, when these utilities are executed by a privileged process over a path controlled by the attacker, this can lead to local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity flaw in the `getfattr` utility allows a local attacker to achieve privilege escalation. Exploitation requires a privileged process to invoke `getfattr` on a path controlled by the attacker, where a symbolic link can redirect operations to arbitrary files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54371"
},
{
"category": "external",
"summary": "RHBZ#2490283",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54371"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr"
},
{
"cve": "CVE-2026-54874",
"cwe": {
"id": "CWE-405",
"name": "Asymmetric Resource Consumption (Amplification)"
},
"discovery_date": "2026-08-17T19:33:30.960000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517564"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. Receiving a DTLS (Datagram Transport Layer Security) record for a future epoch while a handshake is in progress causes OpenSSL to buffer an excessive amount of memory. This allows a peer to cause memory exhaustion, eventually resulting in a denial of service, using a small amount of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: excessive memory use buffering DTLS records for a future epoch",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to send a DTLS record for a future epoch while the handshake is in progress. This can cause excessive consumption of memory, eventually resulting in a denial of service. However, the retained memory is limited to 1.7MB per connection and the limit on simultaneous connections can prevent successful exploitation. For these reasons, this vulnerability has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54874"
},
{
"category": "external",
"summary": "RHBZ#2517564",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517564"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54874",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54874"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54874",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54874"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: excessive memory use buffering DTLS records for a future epoch"
},
{
"cve": "CVE-2026-56392",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-07-24T09:01:08.479352+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506694"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GNU coreutils, specifically in the `unexpand` utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when `unexpand` processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing subsequent operations to write beyond its boundaries. Successful exploitation can cause the `unexpand` utility to crash, potentially resulting in a denial of service or enabling further memory manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate impact heap-based buffer overflow flaw was found in the `unexpand` utility of GNU coreutils. This vulnerability arises from an integer overflow when processing unusually large tab stop values, leading to an undersized buffer. A local attacker could exploit this by providing crafted input, causing the utility to crash and potentially leading to a denial of service or arbitrary memory manipulation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56392"
},
{
"category": "external",
"summary": "RHBZ#2506694",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506694"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56392"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56392",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56392"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/07/CVE-2026-56391",
"url": "https://cert.pl/en/posts/2026/07/CVE-2026-56391"
},
{
"category": "external",
"summary": "https://git.savannah.gnu.org/cgit/coreutils.git/",
"url": "https://git.savannah.gnu.org/cgit/coreutils.git/"
},
{
"category": "external",
"summary": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d",
"url": "https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"
}
],
"release_date": "2026-07-24T07:44:54.885000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values"
},
{
"cve": "CVE-2026-56852",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-21T20:01:56.266823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2504233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56852"
},
{
"category": "external",
"summary": "RHBZ#2504233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
},
{
"category": "external",
"summary": "https://go.dev/cl/794100",
"url": "https://go.dev/cl/794100"
},
{
"category": "external",
"summary": "https://go.dev/issue/80142",
"url": "https://go.dev/issue/80142"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5970",
"url": "https://pkg.go.dev/vuln/GO-2026-5970"
}
],
"release_date": "2026-07-21T19:18:59.951000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
},
{
"cve": "CVE-2026-56854",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-08-28T15:33:34.404578+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2525639"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The component failed to properly enforce source-address restrictions for several authentication methods, including password and keyboard-interactive callbacks. In applications that misuse the ServerConfig.PublicKeyCallback callback to make security relevant authorization decisions, an attacker with a valid key could bypass network-based access controls to gain additional privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability severity is Important due to the requirement that an attacker already have a valid private key. A flaw in golang.org/x/crypto/ssh allows remote attackers to bypass source-address restrictions for certain authentication methods. This would allow an attacker to use a valid key for gaining additional privileges outside of the bounds of the network-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56854"
},
{
"category": "external",
"summary": "RHBZ#2525639",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2525639"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56854",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56854"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56854",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56854"
},
{
"category": "external",
"summary": "https://go.dev/cl/797040",
"url": "https://go.dev/cl/797040"
},
{
"category": "external",
"summary": "https://go.dev/issue/80213",
"url": "https://go.dev/issue/80213"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-6303",
"url": "https://pkg.go.dev/vuln/GO-2026-6303"
}
],
"release_date": "2026-08-28T15:14:26.918000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58010",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:21:49.589000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492243"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses \u003e instead of \u003e=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications calling the `g_variant_is_normal_form()`,\u00a0`g_variant_get_normal_form()` or\u00a0`g_variant_byteswap()` functions that process untrusted GVariant data received from D-Bus, network or file are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 1 byte, leading to an information disclosure of only 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58010"
},
{
"category": "external",
"summary": "RHBZ#2492243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58010"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915"
}
],
"release_date": "2026-03-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58011",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-24T16:30:03.305000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492245"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications that allow a user to submit a date to `g_date_time_add_full()` and later call any getter functions, such as `g_date_time_get_month()` or `g_date_time_get_year()`, with the returned GDateTime object are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 2 bytes, leading to a denial of service due to logic errors that a corrupted date can trigger. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58011"
},
{
"category": "external",
"summary": "RHBZ#2492245",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917"
}
],
"release_date": "2026-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58012",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:40:58.048000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492247"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications that use g_regex_replace() or g_regex_replace_eval() with the G_REGEX_RAW compile flag and allow user-controlled replacement strings containing case-change escapes (\\u,\u00a0\\l,\u00a0\\U,\u00a0\\L) are vulnerable to this issue. This flaw can cause a buffer over-read of 1-5 bytes, leading to a minor information disclosure and a denial of service when the buffer over-read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58012"
},
{
"category": "external",
"summary": "RHBZ#2492247",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58012"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918"
}
],
"release_date": "2026-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement strict input validation to sanitize user-supplied replacement strings, specifically rejecting or escaping case-change modifiers (\\u, \\l, \\U, \\L) before calling g_regex_replace() or g_regex_replace_eval() when the G_REGEX_RAW compile flag is used. Removing the G_REGEX_RAW flag or hardcoding the replacement strings will completely neutralize this issue.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58013",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:49:18.947000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492248"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications calling g_io_channel_set_line_term() with a multi-byte line terminator (length greater than one) and subsequently calling g_io_channel_read_line_backend() are vulnerable to this issue. This flaw can cause a buffer over-read of 8 bytes, leading to an information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58013"
},
{
"category": "external",
"summary": "RHBZ#2492248",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58013"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925"
}
],
"release_date": "2026-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\""
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58014",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"discovery_date": "2026-06-24T17:16:25.796000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492255"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58014"
},
{
"category": "external",
"summary": "RHBZ#2492255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58014"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\""
},
{
"acknowledgments": [
{
"names": [
"Thepwnisher"
]
}
],
"cve": "CVE-2026-58015",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-24T17:22:00.405000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing), increasing the complexity of exploitation. However, if successful, this issue allows the exfiltration of sensitive secrets, such as SSH keys or API tokens, from the filesystem. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58015"
},
{
"category": "external",
"summary": "RHBZ#2492256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58015"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58016",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-24T17:29:08.344000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492257"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications processing D-Bus introspection XML input from untrusted sources with g_dbus_node_info_new_for_xml() are vulnerable to this issue. In GLib itself, the gdbus command line tool is the primary vector for local exploitation. However, other applications using the vulnerable function may process untrusted input in a way that allows a remote attacker to trigger this flaw. This vulnerability can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58016"
},
{
"category": "external",
"summary": "RHBZ#2492257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58016"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted D-Bus introspection XML, specifically rejecting malformed structures such as \u003cnode\u003e elements improperly nested within \u003cmethod\u003e, \u003csignal\u003e, \u003cproperty\u003e or \u003carg\u003e elements before calling g_dbus_node_info_new_for_xml(). Alternatively, restricting the application to only process XML input from trusted, authenticated sources will completely neutralize this issue.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\""
},
{
"cve": "CVE-2026-58055",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-06-28T03:01:22.756250+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2493954"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in nghttp2\u0027s nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw in nghttp2\u0027s nghttpx proxy allows remote HTTP request smuggling and cross-client response poisoning by forwarding malformed HTTP/1.1 Upgrade requests containing a Content-Length body. This is rated Moderate because successful exploitation requires high attack complexity on the backend server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58055"
},
{
"category": "external",
"summary": "RHBZ#2493954",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493954"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58055",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58055"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58055",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58055"
},
{
"category": "external",
"summary": "https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc",
"url": "https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc"
},
{
"category": "external",
"summary": "https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e",
"url": "https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length",
"url": "https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length"
}
],
"release_date": "2026-06-28T01:32:57.163000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Configure your WAF or load balancer to drop incoming HTTP/1.1 requests that contain both Upgrade and Content-Length headers. This blocks the malformed traffic at the edge before it can reach the vulnerable proxy without impacting legitimate users.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests"
},
{
"cve": "CVE-2026-63072",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-17T19:24:54.673000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517560"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: heap buffer overflow in CMS key unwrapping",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to supply a crafted CMS message to be decrypted in an application by CMS_decrypt(). The out-of-bounds write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the memory allocation, causing memory corruption, but the impact is limited to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63072"
},
{
"category": "external",
"summary": "RHBZ#2517560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517560"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: heap buffer overflow in CMS key unwrapping"
},
{
"cve": "CVE-2026-63073",
"cwe": {
"id": "CWE-134",
"name": "Use of Externally-Controlled Format String"
},
"discovery_date": "2026-08-17T19:42:56.692000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517565"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A malicious CMP (Certificate Management Protocol) endpoint can send an unexpected distinguished name (DN) directly as the format string argument to ERR_raise_data(), causing the application to dereference and write to unrelated stack contents. This can lead to a crash in the CMP client, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: untrusted sender DN used as format string in CMP response validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Applications acting as a CMP client connecting to a malicious or intercepted CMP server are vulnerable to this issue, limiting its exposure. Also, the CMP client needs to enforce an expected sender or use a pinned server certificate whose subject becomes the default expected sender. This flaw can cause the application to dereference and write to unrelated stack contents, leading to a crash in the CMP client and resulting in a denial of service. There is no controlled memory write, arbitrary-address read or path to code execution. For these reasons, this vulnerability has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63073"
},
{
"category": "external",
"summary": "RHBZ#2517565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517565"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63073"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63073",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63073"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: untrusted sender DN used as format string in CMP response validation"
},
{
"cve": "CVE-2026-63074",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-17T19:47:06.273000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517566"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. The CMP (Certificate Management Protocol) implementation does not clear cached additional certificates when an invalid message is received, leading to excessive memory consumption. This allows a malicious client to repeatedly send requests containing unique extra certificates to cause memory exhaustion, eventually resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: CMP indefinite cache growth of ExtraCerts",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to repeatedly send invalid messages containing additional certificates to a CMP server. However, this issue only affects CMP servers with long-lived context objects. This can grow the extra certificates cache and cause excessive memory consumption, eventually resulting in a denial of service. For these reasons, this vulnerability has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63074"
},
{
"category": "external",
"summary": "RHBZ#2517566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517566"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63074"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: CMP indefinite cache growth of ExtraCerts"
},
{
"cve": "CVE-2026-63075",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-17T19:50:01.587000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517570"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. The QUIC protocol implementation retains metadata for ACK-only packets for the lifetime of a connection, leading to excessive memory consumption. This allows a peer to repeatedly send ack-eliciting packets while not acknowledging ACK-only responses to cause memory exhaustion, eventually resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: QUIC ACK-only packet retention can cause memory exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to complete a QUIC handshake and repeatedly send ack-eliciting packets while not acknowledging ACK-only responses. This causes the QUIC implementation to retain metadata for ACK-only responses for the lifetime of a connection, leading to excessive memory consumption, eventually resulting in a denial of service with no other security impact. For these reasons, this vulnerability has been rated with a low severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63075"
},
{
"category": "external",
"summary": "RHBZ#2517570",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517570"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63075"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63075",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63075"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T16:05:51.415000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion"
},
{
"cve": "CVE-2026-63076",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-08-17T19:30:30.087000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517561"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to supply a crafted CMP message to an application acting as a CMP server or client. Server applications need to be configured to accept PBM-protected messages, and client applications need to communicate with a malicious or intercepted CMP server. The missing type check causes an invalid pointer dereference, resulting in a denial of service. There is no memory disclosure, no controlled memory write and no path to code execution. For these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63076"
},
{
"category": "external",
"summary": "RHBZ#2517561",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63076"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg"
},
{
"cve": "CVE-2026-63379",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-20T18:11:26.473492+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520667"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP (Hypertext Transfer Protocol) trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers, causing an upstream proxy and the Libevent application to interpret different effective headers. This can lead to header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat ships libevent in multiple products including Red Hat Enterprise Linux, RHIVOS, and as part of RHCOS in OpenShift. All shipped versions are prior to the fix in 2.1.13 and are affected by this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63379"
},
{
"category": "external",
"summary": "RHBZ#2520667",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520667"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63379"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636",
"url": "https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485",
"url": "https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6"
}
],
"release_date": "2026-08-20T17:55:00.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning"
},
{
"cve": "CVE-2026-63381",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-08-20T18:02:05.183416+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520657"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the `evbuffer_add_buffer_reference` function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or crash the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Memory corruption due to use-after-free",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux, OpenShift (RHCOS), RHIVOS, and community products (Fedora, Hummingbird) ship affected versions of libevent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63381"
},
{
"category": "external",
"summary": "RHBZ#2520657",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520657"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63381"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63381",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63381"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c",
"url": "https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9",
"url": "https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8"
}
],
"release_date": "2026-08-20T17:50:09.322000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libevent: Libevent: Memory corruption due to use-after-free"
},
{
"cve": "CVE-2026-63382",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-20T18:02:20.622823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520660"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libevent. The evhttp parser in libevent\u0027s http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successful exploitation could lead to request smuggling, potentially bypassing access controls or poisoning caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux, OpenShift (RHCOS), RHIVOS, and community products (Fedora, Hummingbird) ship affected versions of libevent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63382"
},
{
"category": "external",
"summary": "RHBZ#2520660",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520660"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63382"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63382",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63382"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
"url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
"url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
"url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
"url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
}
],
"release_date": "2026-08-20T17:51:15.156000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling"
},
{
"cve": "CVE-2026-63383",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-08-20T18:01:02.048026+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520654"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the `decode_tag_internal()` function by sending specially crafted, attacker-controlled tagged RPC (Remote Procedure Call) data. This could lead to a denial of service, causing the process that decodes the data to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Denial of Service via malformed RPC data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in libevent can lead to a denial of service. An attacker could send specially crafted RPC data to a service utilizing libevent, causing an out-of-bounds read and crashing the application. This vulnerability primarily affects applications that process untrusted RPC data using libevent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63383"
},
{
"category": "external",
"summary": "RHBZ#2520654",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520654"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63383"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63383",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63383"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321",
"url": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb",
"url": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"
}
],
"release_date": "2026-08-20T17:48:24.568000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: Denial of Service via malformed RPC data"
},
{
"cve": "CVE-2026-63384",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-08-20T18:01:40.543023+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520658"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent. An incorrect integer conversion in the `evtag_unmarshal_header` function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. A remote attacker can trigger a denial of service in applications utilizing Libevent\u0027s event tagging feature by sending a specially crafted payload. The incorrect integer conversion can lead to excessive memory allocation, causing resource exhaustion.\nThis issue is fixed in versions 2.1.13 and 2.2.2-alpha.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63384"
},
{
"category": "external",
"summary": "RHBZ#2520658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520658"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63384"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63384",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63384"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda",
"url": "https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416",
"url": "https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8"
}
],
"release_date": "2026-08-20T17:53:08.417000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`"
},
{
"cve": "CVE-2026-63385",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-20T18:11:18.605370+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520666"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libevent. The evhttp_decode_uri_internal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes /admin/secret, bypassing path-based access controls. Additionally, evhttp_header_is_valid_value accepts obsolete HTTP header line folding (CRLF followed by SP/HT), which RFC 9112 states new implementations should reject, creating a header injection vector in proxy chains where the frontend rejects obs-fold but libevent accepts it. This could lead to access control bypass, header injection, or request smuggling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: HTTP header handling bugs create risk of access control bypass.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux, OpenShift (RHCOS), RHIVOS, and community products (Fedora, Hummingbird) ship affected versions of libevent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63385"
},
{
"category": "external",
"summary": "RHBZ#2520666",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520666"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63385"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0",
"url": "https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2",
"url": "https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2"
}
],
"release_date": "2026-08-20T17:55:36.214000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: HTTP header handling bugs create risk of access control bypass."
},
{
"cve": "CVE-2026-63387",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-20T18:01:14.389593+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520655"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the `dnsname_to_labels` function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the process, resulting in a denial of service or potential information disclosure and integrity impact.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in the libevent library\u0027s DNS parsing component can lead to a denial of service or data corruption due to an off-by-one stack buffer overflow. A remote attacker can exploit this flaw with low attack complexity by providing a specially crafted DNS server response to services utilizing libevent for DNS resolution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63387"
},
{
"category": "external",
"summary": "RHBZ#2520655",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520655"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63387"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63387",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63387"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47"
}
],
"release_date": "2026-08-20T17:53:41.863000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption"
},
{
"cve": "CVE-2026-63388",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-20T18:02:33.843530+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520661"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the `bufferevent_socket_set_conn_address_` function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AF_UNIX listener, an attacker can overwrite critical heap data, leading to memory corruption and potentially full control over the affected system. This can severely impact the confidentiality, integrity, and availability of data and services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in libevent that allows an unauthenticated local attacker to achieve arbitrary code execution. By connecting to an AF_UNIX listener, an attacker can trigger a heap out-of-bounds write, leading to memory corruption and high impact on system confidentiality, integrity, and availability. The local attack vector limits the immediate threat, but the unauthenticated nature and severe consequences elevate its importance.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63388"
},
{
"category": "external",
"summary": "RHBZ#2520661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520661"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63388"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9",
"url": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72",
"url": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338"
}
],
"release_date": "2026-08-20T17:44:18.435000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling"
},
{
"cve": "CVE-2026-84445",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-14T16:22:17.356407+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2533175"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer() can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a Denial of Service (DoS). In some deployments, this attack can be unauthenticated.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84445"
},
{
"category": "external",
"summary": "RHBZ#2533175",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2533175"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84445"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84445"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7",
"url": "https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4",
"url": "https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f",
"url": "https://github.com/grpc/grpc-go/commit/93e31b48545e2a8aaeb6e06b47fb249f94e6297f"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/issues/9354",
"url": "https://github.com/grpc/grpc-go/issues/9354"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/pull/9365",
"url": "https://github.com/grpc/grpc-go/pull/9365"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/pull/9366",
"url": "https://github.com/grpc/grpc-go/pull/9366"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/pull/9367",
"url": "https://github.com/grpc/grpc-go/pull/9367"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2",
"url": "https://github.com/grpc/grpc-go/releases/tag/v1.82.2"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2",
"url": "https://github.com/grpc/grpc-go/releases/tag/v1.83.2"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj"
}
],
"release_date": "2026-09-14T16:11:41.401000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T07:22:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nThe steps to apply the upgraded images are different depending on the installation plan approval policy you used\nwhen installing the cert-manager Operator for Red Hat OpenShift.\n\n- If the approval policy is set to `Automatic`, then the Operator will be upgraded automatically when there is a\nnew version of the Operator. No further action is required to upgrade. This is the default setting.\n\n- If you changed the approval policy to `Manual`, then you must manually approve the upgrade to the Operator.\n\nSee https://docs.openshift.com/container-platform/latest/security/cert_manager_operator/index.html for additional\ninformation.",
"product_ids": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:72399"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:0bfd185a474fc2a5adf322c153f804799f38e0cb190528ff0b9be9c101c3eaca_s390x",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:4448c2c0b13f63a95312a0c023208133f4987e3815aaf8f02361d3f1b099553f_amd64",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:45529b1a8cd9562986a7a6d4dc459a2638ad417e9bf172d7ef9c62ad21443aa2_ppc64le",
"Cert Manager support for Red Hat OpenShift release 1.20:registry.redhat.io/cert-manager/cert-manager-operator-rhel9@sha256:da5ea3c112696151994abab6160aaa0c51a9644f1a24d190ef54c7fcb3fd7755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…