RHBA-2026:68628 - Bug Fix Advisory

Topic

This erratum covers updates to the current Red Hat JBoss Web Server 6.2 for OpenShift images to fix python3, curl and sqlite-libs CVEs.

Description

Red Hat xPaaS provides images for many of the Red Hat Middleware products that are available for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments.

The current JBoss Web Server 6.2 for OpenShift images have been updated to fix the following CVEs:

• python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940)
• curl: curl: Insecure connection establishment due to TLS configuration mismatch (CVE-2026-8286)
• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)

Solution

To update to the latest JBoss Web Server 6.2.4 for OpenShift image on UBI8, perform the following steps to pull in the content:

1. On your master host(s), ensure that you are logged in to the command line interface as a cluster administrator or user who has project administrator access to the global "openshift" project:

$ oc login -u system:admin

2. Depending on the OpenJDK version, run one of the following commands to update the core JBoss Web Server 6.2 tomcat 10 OpenShift image stream in the "openshift" project:

• For OpenJDK 17:

To update the core JBoss Web Server 6.2 tomcat 10 with OpenJDK 17 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver62-openjdk17-tomcat10-openshift-ubi8:6.2.4

• For OpenJDK 21:

To update the core JBoss Web Server 6.2 tomcat 10 with OpenJDK 21 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver62-openjdk21-tomcat10-openshift-ubi8:6.2.4

Affected Products

• Red Hat OpenShift Container Platform 4.12 for RHEL 8 x86_64
• Red Hat OpenShift Container Platform 4.11 for RHEL 8 x86_64

Fixes

CVEs

• CVE-2026-8286
• CVE-2026-11822
• CVE-2026-11824
• CVE-2026-11940
• CVE-2026-11979
• CVE-2026-16118
• CVE-2026-28420
• CVE-2026-41991
• CVE-2026-41992
• CVE-2026-45409
• CVE-2026-50219
• CVE-2026-52859
• CVE-2026-54371
• CVE-2026-54411
• CVE-2026-55892
• CVE-2026-56132
• CVE-2026-58055
• CVE-2026-58469
• CVE-2026-58471
• CVE-2026-58472
• CVE-2026-59843
• CVE-2026-59844
• CVE-2026-59845
• CVE-2026-59846
• CVE-2026-59847
• CVE-2026-59848
• CVE-2026-59850
• CVE-2026-59857
• CVE-2026-60589
• CVE-2026-61308
• CVE-2026-70907
• CVE-2026-73072
• CVE-2026-73076
• CVE-2026-73078

References

• https://access.redhat.com/errata/RHSA-2026:56219
• https://access.redhat.com/errata/RHSA-2026:57462
• https://access.redhat.com/errata/RHSA-2026:58938