RHSA-2026:67857
Vulnerability from csaf_redhat - Published: 2026-09-28 02:01 - Updated: 2026-09-28 10:06Summary
Red Hat Security Advisory: OpenShift Container Platform 4.15.69 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.15.69 is now available with updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container Platform 4.15.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.69. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:67856
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/
Security Fix(es):
* libxml2: Use-After-Free in libxml2 (CVE-2024-56171)
* unbound: Unbound Cache poisoning (CVE-2025-5994)
* sqlite: Integer Truncation in SQLite (CVE-2025-6965)
* podman: Podman kube play command may overwrite host files (CVE-2025-9566)
* libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)
* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)
* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)
* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)
* dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)
* dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)
* gnutls: gnutls: Authentication Bypass via NUL Character in Username (CVE-2026-42010)
* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
* openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230)
* samba: vfs_worm does not block directory modification (CVE-2026-2340)
* gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833)
* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)
* systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libxml2. This vulnerability allows a use-after-free via a crafted XML document validated against an XML schema with certain identity constraints or a crafted XML schema.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A cache poisoning flaw was found in Unbound. Resolvers supporting EDNS Client Subnet (ECS) must segregate outgoing queries to accommodate different outgoing ECS information. This issue reopens resolvers to a birthday paradox attack, known as the Rebirthday Attack, which attempts to match the DNS transaction ID with cache non-ECS poisoned replies.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A memory corruption flaw was found in SQLite. Under specific conditions a query can be generated where the number of aggregate terms could exceed the number of columns available. This issue could lead to memory corruption and subsequent unintended behavior.
7.7 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).
5.6 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Moderate
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A flaw was found in libxml2. This vulnerability allows a stack-based buffer overflow via DTD validation of an untrusted document or untrusted DTD.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
9.1 (Critical)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.
9.1 (Critical)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Moderate
A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.
8.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Moderate
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Moderate
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Moderate
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.
7.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
A flaw was found in the Linux kernel's CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2024-56171
Threats
Impact
Important
References
119 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.15.69 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.15.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.15.69. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHSA-2026:67856\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nSecurity Fix(es):\n\n* libxml2: Use-After-Free in libxml2 (CVE-2024-56171)\n* unbound: Unbound Cache poisoning (CVE-2025-5994)\n* sqlite: Integer Truncation in SQLite (CVE-2025-6965)\n* podman: Podman kube play command may overwrite host files (CVE-2025-9566)\n* libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2 (CVE-2025-24928)\n* libxml: Heap use after free (UAF) leads to Denial of service (DoS) (CVE-2025-49794)\n* libxml: Type confusion leads to Denial of service (DoS) (CVE-2025-49796)\n* samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012)\n* dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)\n* dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)\n* gnutls: gnutls: Authentication Bypass via NUL Character in Username (CVE-2026-42010)\n* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)\n* openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap (CVE-2025-9230)\n* samba: vfs_worm does not block directory modification (CVE-2026-2340)\n* gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833)\n* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)\n* systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:67857",
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2346416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2346416"
},
{
"category": "external",
"summary": "2346421",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2346421"
},
{
"category": "external",
"summary": "2372373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372373"
},
{
"category": "external",
"summary": "2372385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385"
},
{
"category": "external",
"summary": "2380149",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380149"
},
{
"category": "external",
"summary": "2380949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380949"
},
{
"category": "external",
"summary": "2393152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393152"
},
{
"category": "external",
"summary": "2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "2445763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
},
{
"category": "external",
"summary": "2447318",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447318"
},
{
"category": "external",
"summary": "2447319",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447319"
},
{
"category": "external",
"summary": "2450505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
},
{
"category": "external",
"summary": "2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "2467015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
},
{
"category": "external",
"summary": "2467289",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
},
{
"category": "external",
"summary": "2493411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
},
{
"category": "external",
"summary": "2500889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67857.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.15.69 bug fix and security update",
"tracking": {
"current_release_date": "2026-09-28T10:06:00+00:00",
"generator": {
"date": "2026-09-28T10:06:00+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:67857",
"initial_release_date": "2026-09-28T02:01:03+00:00",
"revision_history": [
{
"date": "2026-09-28T02:01:03+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-28T02:01:03+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-28T10:06:00+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.15",
"product": {
"name": "Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.15::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-415.92.202609140326-0",
"product": {
"name": "rhcos-aarch64-415.92.202609140326-0",
"product_id": "rhcos-aarch64-415.92.202609140326-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202609140326?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-415.92.202609140326-0",
"product": {
"name": "rhcos-ppc64le-415.92.202609140326-0",
"product_id": "rhcos-ppc64le-415.92.202609140326-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202609140326?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-415.92.202609140326-0",
"product": {
"name": "rhcos-s390x-415.92.202609140326-0",
"product_id": "rhcos-s390x-415.92.202609140326-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202609140326?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-415.92.202609140326-0",
"product": {
"name": "rhcos-x86_64-415.92.202609140326-0",
"product_id": "rhcos-x86_64-415.92.202609140326-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202609140326?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-415.92.202609140326-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0"
},
"product_reference": "rhcos-aarch64-415.92.202609140326-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-415.92.202609140326-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0"
},
"product_reference": "rhcos-ppc64le-415.92.202609140326-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-415.92.202609140326-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0"
},
"product_reference": "rhcos-s390x-415.92.202609140326-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-415.92.202609140326-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
},
"product_reference": "rhcos-x86_64-415.92.202609140326-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-56171",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-02-18T23:01:25.366636+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2346416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. This vulnerability allows a use-after-free via a crafted XML document validated against an XML schema with certain identity constraints or a crafted XML schema.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Use-After-Free in libxml2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as important because it involves a use-after-free flaw in the xmlSchemaIDCFillNodeTables and xmlSchemaBubbleIDCNodeTables functions. A maliciously crafted XML document or schema, containing specific identity constraints, can be used to trigger this vulnerability and potentially gain unauthorized access or cause a denial-of-service condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56171"
},
{
"category": "external",
"summary": "RHBZ#2346416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2346416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56171",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56171"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56171",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56171"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/828",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/828"
}
],
"release_date": "2025-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: Use-After-Free in libxml2"
},
{
"cve": "CVE-2025-5994",
"cwe": {
"id": "CWE-349",
"name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
},
"discovery_date": "2025-07-16T15:01:36.497027+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2380949"
}
],
"notes": [
{
"category": "description",
"text": "A cache poisoning flaw was found in Unbound. Resolvers supporting EDNS Client Subnet (ECS) must segregate outgoing queries to accommodate different outgoing ECS information. This issue reopens resolvers to a birthday paradox attack, known as the Rebirthday Attack, which attempts to match the DNS transaction ID with cache non-ECS poisoned replies.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound Cache poisoning",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is considered Important rather than Moderate because it directly compromises the integrity of DNS caching mechanisms in resolvers supporting EDNS Client Subnet (ECS). The flaw allows an attacker to exploit the birthday paradox by generating a high volume of concurrent queries with different ECS values, thereby increasing the chance of a transaction ID collision with a spoofed response. If the resolver fails to properly segregate cache entries by ECS scope, it may accept and cache a malicious non-ECS response, effectively leading to DNS cache poisoning. Unlike typical poisoning attempts that require precise timing or privileged network positions, this attack can be carried out remotely with a high success rate, especially in resolvers that do not correctly isolate ECS queries.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-5994"
},
{
"category": "external",
"summary": "RHBZ#2380949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-5994",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5994"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5994",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5994"
},
{
"category": "external",
"summary": "https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt",
"url": "https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt"
}
],
"release_date": "2025-07-16T14:38:22.738000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "unbound: Unbound Cache poisoning"
},
{
"cve": "CVE-2025-6965",
"cwe": {
"id": "CWE-197",
"name": "Numeric Truncation Error"
},
"discovery_date": "2025-07-15T14:02:19.241458+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2380149"
}
],
"notes": [
{
"category": "description",
"text": "A memory corruption flaw was found in SQLite. Under specific conditions a query can be generated where the number of aggregate terms could exceed the number of columns available. This issue could lead to memory corruption and subsequent unintended behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: Integer Truncation in SQLite",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in SQLite is categorized as Important rather than Critical because, although it involves memory corruption, the conditions required to trigger it are relatively constrained. The flaw arises when a query causes the number of aggregate terms to exceed internal limits, leading to potential buffer overflows or memory mismanagement. However, exploitation requires the ability to craft complex SQL queries and interact with the SQLite engine in a specific manner\u2014typically through direct SQL input. There is no known evidence of arbitrary code execution, privilege escalation, or remote exploitability as a direct result of this flaw. Additionally, most SQLite deployments are embedded in applications where input is tightly controlled or sanitized.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-6965"
},
{
"category": "external",
"summary": "RHBZ#2380149",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380149"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-6965",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6965"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6965"
},
{
"category": "external",
"summary": "https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL",
"url": "https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL"
},
{
"category": "external",
"summary": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8",
"url": "https://www.sqlite.org/src/info/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8"
}
],
"release_date": "2025-07-15T13:44:00.784000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: Integer Truncation in SQLite"
},
{
"cve": "CVE-2025-9230",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2025-09-17T12:15:34.387000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2396054"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The vulnerability was rated as Moderate because, while the potential impact includes an application level denial of service and possible arbitrary code execution, successful exploitation is considered unlikely due to the high attack complexity and the fact that password-based CMS encryption (PWRI) is rarely used in real-world deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9230"
},
{
"category": "external",
"summary": "RHBZ#2396054",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2396054"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9230",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9230"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9230"
}
],
"release_date": "2025-09-30T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: Out-of-bounds read \u0026 write in RFC 3211 KEK Unwrap"
},
{
"acknowledgments": [
{
"names": [
"Paul Holzinger"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2025-9566",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2025-09-04T15:45:46.448000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2393152"
}
],
"notes": [
{
"category": "description",
"text": "There\u0027s a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file.\n\nBinary-Affected: podman\nUpstream-version-introduced: v4.0.0\nUpstream-version-fixed: v5.6.1",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "podman: Podman kube play command may overwrite host files",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has evaluated this vulnerability as having the Important severity. This happens because of the consequences of an successful attack and the low complexity (AC:L) on exploiting this vulnerability. Although the attacker cannot control the content written to the target file, depending on which file was targeted, the exploitation of this flaw may lead sensitive data corruption (I:H) and leading the system to crash resulting in a Denial of Service attack (A:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-9566"
},
{
"category": "external",
"summary": "RHBZ#2393152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393152"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-9566",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9566"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9566",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9566"
},
{
"category": "external",
"summary": "https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89",
"url": "https://github.com/containers/podman/commit/43fbde4e665fe6cee6921868f04b7ccd3de5ad89"
},
{
"category": "external",
"summary": "https://github.com/containers/podman/security/advisories/GHSA-wp3j-xq48-xpjw",
"url": "https://github.com/containers/podman/security/advisories/GHSA-wp3j-xq48-xpjw"
}
],
"release_date": "2025-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Red Hat advises to not run the podman kube play command with untrusted Kubernetes YAML file as input, additionally review the Kubernetes YAML file before running it through podman may help to catch maliciously crafted secretes or volumes that may be used to exploit this vulnerability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "podman: Podman kube play command may overwrite host files"
},
{
"cve": "CVE-2025-24928",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2025-02-18T23:01:36.502916+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2346421"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. This vulnerability allows a stack-based buffer overflow via DTD validation of an untrusted document or untrusted DTD.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as important because it involves a stack-based buffer overflow in the xmlSnprintfElements function within valid.c. Exploiting this issue requires DTD validation to occur on an untrusted document or untrusted DTD, making it a potential security risk for applications using libxml2 that do not adequately restrict DTD input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-24928"
},
{
"category": "external",
"summary": "RHBZ#2346421",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2346421"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-24928",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24928"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24928",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24928"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/847",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/847"
},
{
"category": "external",
"summary": "https://issues.oss-fuzz.com/issues/392687022",
"url": "https://issues.oss-fuzz.com/issues/392687022"
}
],
"release_date": "2025-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2"
},
{
"cve": "CVE-2025-49794",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2025-06-11T21:33:43.044000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2372373"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the \u003csch:name path=\"...\"/\u003e schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program\u0027s crash using libxml or other possible undefined behaviors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml: Heap use after free (UAF) leads to Denial of service (DoS)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue was rated with a severity impact of Important by Red Hat Product Security, as libxml can be used to parse XML coming from the network depending on how the program consumes it and uses the library. Additionally, although the initial report shows a crash due to invalid memory access (A:H), other undefined issues that can present data integrity due to the application overwriting sensitive data are not discarded (I:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-49794"
},
{
"category": "external",
"summary": "RHBZ#2372373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372373"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-49794",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49794"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49794"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/931",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/931"
}
],
"release_date": "2025-06-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "There\u0027s no available mitigation other than avoid processing untrusted XML documents before updating to the libxml version containing the fix.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml: Heap use after free (UAF) leads to Denial of service (DoS)"
},
{
"cve": "CVE-2025-49796",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2025-06-12T00:35:26.470000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2372385"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml: Type confusion leads to Denial of service (DoS)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has evaluated this vulnerability as having an Important security impact, as libxml can be used to parse XML from the network depending on how the program consumes it using the library. Additionally, although the initial report shows a crash due to invalid memory access (A:H), other undefined issues that can present data integrity due to the application overwriting sensitive data are not discarded (I:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-49796"
},
{
"category": "external",
"summary": "RHBZ#2372385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372385"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-49796",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49796"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49796"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/933",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/933"
}
],
"release_date": "2025-06-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "There\u0027s no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml: Type confusion leads to Denial of service (DoS)"
},
{
"acknowledgments": [
{
"names": [
"Pavel Kohout"
],
"organization": "Aisle Research"
}
],
"cve": "CVE-2026-2340",
"cwe": {
"id": "CWE-280",
"name": "Improper Handling of Insufficient Permissions or Privileges"
},
"discovery_date": "2026-03-13T12:55:04.465000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447318"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Samba\u2019s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenticated user with write access to a share could overwrite a protected file by renaming a newly created file over the existing WORM-protected file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "samba: vfs_worm does not block directory modification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate severity because exploitation requires authenticated write access to a Samba share already configured to permit file creation and modification.\n\nThe flaw affects the vfs_worm module, which provides additional immutability protections for files after a configurable grace period. Due to improper handling of rename operations, a user with existing write permissions could overwrite files that should have become immutable under the WORM policy.\n\nThe vulnerability does not bypass underlying filesystem access controls or grant additional privileges beyond those already assigned to the authenticated user. However, because the primary purpose of the vfs_worm module is to protect file integrity, the ability to modify protected files results in a high integrity impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2340"
},
{
"category": "external",
"summary": "RHBZ#2447318",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447318"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2340"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2340",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2340"
},
{
"category": "external",
"summary": "https://bugzilla.samba.org/show_bug.cgi?id=15997",
"url": "https://bugzilla.samba.org/show_bug.cgi?id=15997"
}
],
"release_date": "2026-05-27T10:35:47.805000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Administrators can mitigate this issue by:\n\nSetting read-only permissions on protected files at the underlying filesystem level will prevent modifications.\n\nConfiguring ```worm:grace_period = 0``` (zero or less) in smb.conf will eliminate the writable grace period (will eliminate the window in which the rename can happen), understanding that this may impact workflows requiring multi-step file creation.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "samba: vfs_worm does not block directory modification"
},
{
"acknowledgments": [
{
"names": [
"Arad Inbar",
"Nir Somech",
"Ben Grinberg"
],
"organization": "DREAM Security Research Team"
},
{
"names": [
"Michalis Vasileiadis"
]
}
],
"cve": "CVE-2026-3012",
"cwe": {
"id": "CWE-345",
"name": "Insufficient Verification of Data Authenticity"
},
"discovery_date": "2026-03-13T12:55:02.623000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447319"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Samba\u2019s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect network traffic could exploit this behavior to supply a malicious certificate authority certificate, potentially allowing interception or spoofing of trusted communications.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "samba: group policy certificate enrollment uses http:// without validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as Important severity. \n\nHowever, exploitation requires several specific non-default conditions to be met. The vulnerable code path is only reachable when Samba Group Policy processing is explicitly enabled using the ```apply group policies = yes``` configuration option and certificate auto-enrollment is configured through Group Policy.\n\nHence, although the vulnerable code is present, it is not exploitable in default RHEL configurations. \n\nIn addition, the attacker must have the ability to intercept or redirect adjacent-network HTTP traffic during certificate retrieval. Because exploitation depends on explicit administrative configuration changes and adjacent-network positioning, Red Hat assesses the attack complexity as High (AC:H).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3012"
},
{
"category": "external",
"summary": "RHBZ#2447319",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447319"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3012"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3012",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3012"
},
{
"category": "external",
"summary": "https://bugzilla.samba.org/show_bug.cgi?id=16003",
"url": "https://bugzilla.samba.org/show_bug.cgi?id=16003"
}
],
"release_date": "2026-05-27T09:17:49.862000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Systems are not affected unless Samba Group Policy processing and certificate auto-enrollment are explicitly enabled.\n\nAdministrators can reduce exposure by:\n\nAvoiding unnecessary use of certificate auto-enrollment.\nEnsuring your \"smb.conf\" does not contain a line like ```apply group policies = yes```. If , group policy is not be enabled, the vulnerable code will not run.\n\nIntercepting the HTTP request requires some control over the local network or other devices to intercept or redirect traffic. Some network administrators might assess this as a low risk on their\nnetworks.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "samba: group policy certificate enrollment uses http:// without validation"
},
{
"cve": "CVE-2026-3833",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"discovery_date": "2026-03-09T14:02:09.783000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445763"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is particularly important because it affects the correct enforcement of X.509 nameConstraints, which are specifically designed to limit the authority of subordinate CAs. In GnuTLS, the use of case-sensitive comparisons (memcmp) for dNSName and the domain portion of rfc822Name violates the case-insensitive matching requirements defined in RFC 5280 and RFC 4343. As a result, a constrained subordinate CA can bypass excludedSubtrees or permittedSubtrees restrictions simply by changing the letter casing of a domain in the SAN (e.g., ExAmPlE.CoM vs example.com). Since nameConstraints are often the only mechanism enforcing domain boundaries in delegated PKI hierarchies, this flaw effectively allows a malicious or compromised sub-CA to issue certificates for domains that should be cryptographically prohibited, enabling unauthorized certificate validation and potential TLS impersonation of restricted services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-3833"
},
{
"category": "external",
"summary": "RHBZ#2445763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445763"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-3833",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3833"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3833"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1803",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1803"
}
],
"release_date": "2026-04-30T17:26:28.969000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison"
},
{
"acknowledgments": [
{
"names": [
"AISLE Research"
]
}
],
"cve": "CVE-2026-6893",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-04-21T02:37:23+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2459963"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut\u0027s legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system\u0027s boot and network behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dracut: dracut: Root code execution via DHCP options command injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in dracut\u0027s legacy DHCP client script (`dhclient-script.sh`) that allows command injection. An attacker on the adjacent network can exploit this by providing specially crafted DHCP options, leading to root code execution within the initramfs. This primarily affects systems configured to use DHCP for network setup during the initial boot phase.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6893"
},
{
"category": "external",
"summary": "RHBZ#2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6893"
}
],
"release_date": "2026-06-10T19:39:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that systems configured to obtain network settings via DHCP in the initramfs are only booted on trusted networks. This vulnerability requires an attacker to control a DHCP server on the adjacent network segment. If network configuration via DHCP is not strictly necessary during the initramfs phase, consider using static network configuration.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dracut: dracut: Root code execution via DHCP options command injection"
},
{
"cve": "CVE-2026-14164",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2493411"
}
],
"notes": [
{
"category": "description",
"text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14164"
},
{
"category": "external",
"summary": "RHBZ#2493411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/issues/3069",
"url": "https://github.com/libarchive/libarchive/issues/3069"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/3071",
"url": "https://github.com/libarchive/libarchive/pull/3071"
}
],
"release_date": "2026-05-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
},
{
"acknowledgments": [
{
"names": [
"Pavel Valena"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-15816",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-06-10T19:21:21+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500889"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this flaw\u0027s impact as Important. Exploitation requires an attacker-controlled or spoofed DHCP server on the same network segment as a system performing network boot (root=dhcp/netroot=dhcp), and for the DHCP-supplied ROOT_PATH value to fail dracut\u0027s netroot handler resolution -- both fully within an adjacent-network attacker\u0027s control. Reaching the point where the poisoned hook script is actually sourced depends on dracut\u0027s boot-failure handling reinvoking the emergency shell mechanism, which occurs by default when the netroot handler cannot be resolved. This is a separate code path from CVE-2026-6893, which patched modules.d/35network-legacy/dhclient-script.sh but did not modify dracut-lib.sh\u0027s die() function. Systems that do not perform network/PXE boot, or that do not rely on DHCP-supplied ROOT_PATH values, are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15816"
},
{
"category": "external",
"summary": "RHBZ#2500889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15816"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh",
"url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh",
"url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh"
}
],
"release_date": "2026-08-05T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()"
},
{
"cve": "CVE-2026-29111",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-03-23T22:01:54.593547+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"category": "external",
"summary": "RHBZ#2450505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
"url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
"url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
"url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
"url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
"url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69",
"url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
"url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
"url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
"url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764",
"url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
}
],
"release_date": "2026-03-23T21:03:56.120000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-42010",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"discovery_date": "2026-05-06T16:57:37.044000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467289"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest\u2013Shamir\u2013Adleman \u2013 Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Authentication Bypass via NUL Character in Username",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42010"
},
{
"category": "external",
"summary": "RHBZ#2467289",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467289"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42010"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42010",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42010"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username"
},
{
"cve": "CVE-2026-43112",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-05-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467015"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s CIFS (Common Internet File System) client. When the `cifs_sanitize_prepath` function processes specially crafted input, such as an empty string or a string containing only delimiters, it can attempt to read data beyond its allocated memory buffer. This out-of-bounds read can lead to a system crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important out-of-bounds read flaw in the Linux kernel\u0027s CIFS client can lead to a system crash and denial of service. This vulnerability, present in Red Hat Enterprise Linux 8, 9, and 10, and Red Hat In-Vehicle OS 2, can be triggered by processing specially crafted input to the `cifs_sanitize_prepath` function, potentially disrupting system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43112"
},
{
"category": "external",
"summary": "RHBZ#2467015",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43112"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43112",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43112"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026050625-CVE-2026-43112-f37f@gregkh/T"
}
],
"release_date": "2026-05-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-28T02:01:03+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:7d339a1a461033ca021f645a6a0b448808472d7cee184e5fa0a9ccb34a8b156d\n\n (For s390x architecture)\n The image digest is sha256:bc2c70de0cdb11ffd7326b5bf3d514ba6c5e4707f49b0eb78e49621c9f96d318\n\n (For ppc64le architecture)\n The image digest is sha256:bedbdbf3fd7f532c1e035969707d04271c0b9301d6c781d034608f382a11ba3d\n\n (For aarch64 architecture)\n The image digest is sha256:bcd6c0914a58c724e1c8f2b7f7ecd10cc6bb20ec73cf960700bf3a7faf2f308f\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:67857"
},
{
"category": "workaround",
"details": "To mitigate this issue, prevent the `cifs` kernel module from loading if CIFS client functionality is not required. This can be achieved by blacklisting the module.\n\nCreate a file named `/etc/modprobe.d/blacklist-cifs.conf` with the following content:\n```\nblacklist cifs\n```\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect.\n```bash\ndracut -f -v\nreboot\n```\nDisabling the `cifs` module will prevent the system from mounting CIFS network shares, which may impact functionality relying on this protocol.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202609140326-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202609140326-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…