RHBA-2026:68629 - Bug Fix Advisory

Topic

This erratum covers updates to the current Red Hat JBoss Web Server 7.0 for OpenShift images to fix sqlite, rsync and openssl CVEs.

Description

Red Hat xPaaS provides images for many of the Red Hat Middleware products that are available for use within the OpenShift Container Platform cloud computing Platform-as-a-Service (PaaS) for on-premise or private cloud deployments.

The current JBoss Web Server 7.0 for OpenShift images have been updated to fix the following CVEs:

• sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
• sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
• rsync: rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink (CVE-2026-70460)
• rsync: rsync: TLS Certificate Validation Bypass allows interception of encrypted sessions (CVE-2026-70454)
• rsync: rsync: Arbitrary file deletion via malicious file list (CVE-2026-53789)
• rsync: rsync < 3.5.0 Command Injection via Multiple Code Paths (CVE-2026-53790)
• rsync: rsync: Memory corruption via crafted file entries (CVE-2026-70458)
• rsync: rsync: Denial of Service via handshake stall (CVE-2026-70464)
• rsync: rsync: Local Privilege Escalation via Symlink Following (CVE-2026-53803)
• rsync: rsync: Unauthorized File Access via Symlink Module Root (CVE-2026-53784)
• rsync: rsync: Authorization bypass via `auth users` directive parsing (CVE-2026-70463)
• rsync: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure (CVE-2026-70452)
• rsync: rsync < 3.5.0 Daemon IP Spoofing via PROXY Protocol Header (CVE-2026-53791)
• rsync: rsync: Arbitrary file write via --temp-dir or --link-dest options (CVE-2026-53795)
• rsync: rsync: Heap Out-of-Bounds Write via crafted argument list (CVE-2026-70456)
• rsync: rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode (CVE-2026-53793)
• rsync: rsync: Denial of Service via Algorithmic Complexity (CVE-2026-70453)
• rsync: rsync: Memory corruption via out-of-bounds write in size parsing (CVE-2026-70457)
• rsync: rsync: Information disclosure and denial of service via crafted files-from entry (CVE-2026-70461)
• rsync: rsync: Arbitrary File Read via Symlink Following (CVE-2026-53802)
• rsync: rsync: Arbitrary file write via path traversal in --relative mode (CVE-2026-53785)
• rsync: rsync: Directory escape via TOCTOU race condition in rrsync (CVE-2026-53783)
• openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)
• openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)
• openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
• openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)
• openssl: RPK server signature algorithm selection can dereference a missing certificate (CVE-2026-14457)
• openssl: excessive memory use buffering DTLS records for a future epoch (CVE-2026-54874)
• openssl: untrusted sender DN used as format string in CMP response validation (CVE-2026-63073)
• openssl: CMP indefinite cache growth of ExtraCerts (CVE-2026-63074)
• openssl: QUIC ACK-only packet retention can cause memory exhaustion (CVE-2026-63075)

Solution

To update to the latest JBoss Web Server 7.0.1 for OpenShift image on UBI9, perform the following steps to pull in the content:

1. On your master host(s), ensure that you are logged in to the command line interface as a cluster administrator or user who has project administrator access to the global "openshift" project:

$ oc login -u system:admin

2. Depending on the OpenJDK version, run one of the following commands to update the core JBoss Web Server 7.0 tomcat 11 OpenShift image stream in the "openshift" project:

• For OpenJDK 17:

To update the core JBoss Web Server 7.0 tomcat 11 with OpenJDK 17 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver70-openjdk17-tomcat11-openshift-ubi9:7.0.1

• For OpenJDK 21:

To update the core JBoss Web Server 7.0 tomcat 11 with OpenJDK 21 OpenShift image, run the following command:

$ oc -n openshift import-image jboss-webserver70-openjdk21-tomcat11-openshift-ubi9:7.0.1

Affected Products

• JBoss Enterprise Web Server 7 for RHEL 9 x86_64

Fixes

CVEs

• CVE-2025-49506
• CVE-2026-5704
• CVE-2026-6653
• CVE-2026-11822
• CVE-2026-11824
• CVE-2026-11979
• CVE-2026-14456
• CVE-2026-14457
• CVE-2026-16118
• CVE-2026-18477
• CVE-2026-18508
• CVE-2026-18798
• CVE-2026-32327
• CVE-2026-34501
• CVE-2026-34502
• CVE-2026-50219
• CVE-2026-53783
• CVE-2026-53784
• CVE-2026-53785
• CVE-2026-53789
• CVE-2026-53790
• CVE-2026-53791
• CVE-2026-53793
• CVE-2026-53795
• CVE-2026-53802
• CVE-2026-53803
• CVE-2026-54371
• CVE-2026-54874
• CVE-2026-56132
• CVE-2026-56392
• CVE-2026-58471
• CVE-2026-58472
• CVE-2026-60589
• CVE-2026-61308
• CVE-2026-63072
• CVE-2026-63073
• CVE-2026-63074
• CVE-2026-63075
• CVE-2026-63076
• CVE-2026-70452
• CVE-2026-70453
• CVE-2026-70454
• CVE-2026-70456
• CVE-2026-70457
• CVE-2026-70458
• CVE-2026-70460
• CVE-2026-70461
• CVE-2026-70463
• CVE-2026-70464
• CVE-2026-70907

References

• https://access.redhat.com/errata/RHSA-2026:67165
• https://access.redhat.com/errata/RHSA-2026:67462
• https://access.redhat.com/errata/RHSA-2026:58936