{ "document" : { "aggregate_severity" : { "namespace" : "https://access.redhat.com/security/updates/classification/", "text" : "Important" }, "category" : "csaf_security_advisory", "csaf_version" : "2.0", "distribution" : { "text" : "Copyright © Red Hat, Inc. All rights reserved.", "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "en", "notes" : [ { "category" : "summary", "text" : "Red Hat OpenShift Container Platform release 4.16.75 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.16.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title" : "Topic" }, { "category" : "general", "text" : "Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.16.75. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHSA-2026:95228\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nSecurity Fix(es):\n\n* openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n* openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)\n* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions (CVE-2026-86145)\n* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match (CVE-2026-89161)\n* pcre2: pcre2: Out-of-bounds write via crafted regular expression (CVE-2026-103111)\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n* openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "title" : "Details" }, { "category" : "legal_disclaimer", "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title" : "Terms of Use" } ], "publisher" : { "category" : "vendor", "contact_details" : "https://access.redhat.com/security/team/contact/", "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name" : "Red Hat Product Security", "namespace" : "https://www.redhat.com" }, "references" : [ { "category" : "self", "summary" : "https://access.redhat.com/errata/RHSA-2026:95229", "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "external", "summary" : "https://access.redhat.com/security/updates/classification/#important", "url" : "https://access.redhat.com/security/updates/classification/#important" }, { "category" : "external", "summary" : "2481884", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481884" }, { "category" : "external", "summary" : "2481896", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481896" }, { "category" : "external", "summary" : "2497927", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497927" }, { "category" : "external", "summary" : "2497936", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497936" }, { "category" : "external", "summary" : "2497942", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497942" }, { "category" : "external", "summary" : "2528993", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2528993" }, { "category" : "external", "summary" : "2531747", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2531747" }, { "category" : "external", "summary" : "2543797", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2543797" }, { "category" : "external", "summary" : "OCPBUGS-134633", "url" : "https://issues.redhat.com/browse/OCPBUGS-134633" }, { "category" : "self", "summary" : "Canonical URL", "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95229.json" } ], "title" : "Red Hat Security Advisory: OpenShift Container Platform 4.16.75 bug fix and security update", "tracking" : { "current_release_date" : "2026-11-10T14:09:16+00:00", "generator" : { "date" : "2026-11-10T14:09:16+00:00", "engine" : { "name" : "Red Hat SDEngine", "version" : "5.4.5" } }, "id" : "RHSA-2026:95229", "initial_release_date" : "2026-11-09T01:58:04+00:00", "revision_history" : [ { "date" : "2026-11-09T01:58:04+00:00", "number" : "1", "summary" : "Initial version" }, { "date" : "2026-11-09T01:58:04+00:00", "number" : "2", "summary" : "Last updated version" }, { "date" : "2026-11-10T14:09:16+00:00", "number" : "3", "summary" : "Last generated version" } ], "status" : "final", "version" : "3" } }, "product_tree" : { "branches" : [ { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Red Hat OpenShift Container Platform 4.16", "product" : { "name" : "Red Hat OpenShift Container Platform 4.16", "product_id" : "9Base-RHOSE-4.16", "product_identification_helper" : { "cpe" : "cpe:/a:redhat:openshift:4.16::el9" } } } ], "category" : "product_family", "name" : "Red Hat OpenShift Enterprise" }, { "branches" : [ { "category" : "product_version", "name" : "rhcos-aarch64-416.94.202611031928-0", "product" : { "name" : "rhcos-aarch64-416.94.202611031928-0", "product_id" : "rhcos-aarch64-416.94.202611031928-0", "product_identification_helper" : { "purl" : "pkg:generic/redhat/rhcos@416.94.202611031928?arch=aarch64" } } } ], "category" : "architecture", "name" : "aarch64" }, { "branches" : [ { "category" : "product_version", "name" : "rhcos-ppc64le-416.94.202611031928-0", "product" : { "name" : "rhcos-ppc64le-416.94.202611031928-0", "product_id" : "rhcos-ppc64le-416.94.202611031928-0", "product_identification_helper" : { "purl" : "pkg:generic/redhat/rhcos@416.94.202611031928?arch=ppc64le" } } } ], "category" : "architecture", "name" : "ppc64le" }, { "branches" : [ { "category" : "product_version", "name" : "rhcos-s390x-416.94.202611031928-0", "product" : { "name" : "rhcos-s390x-416.94.202611031928-0", "product_id" : "rhcos-s390x-416.94.202611031928-0", "product_identification_helper" : { "purl" : "pkg:generic/redhat/rhcos@416.94.202611031928?arch=s390x" } } } ], "category" : "architecture", "name" : "s390x" }, { "branches" : [ { "category" : "product_version", "name" : "rhcos-x86_64-416.94.202611031928-0", "product" : { "name" : "rhcos-x86_64-416.94.202611031928-0", "product_id" : "rhcos-x86_64-416.94.202611031928-0", "product_identification_helper" : { "purl" : "pkg:generic/redhat/rhcos@416.94.202611031928?arch=x86_64" } } } ], "category" : "architecture", "name" : "x86_64" } ], "category" : "vendor", "name" : "Red Hat" } ], "relationships" : [ { "category" : "default_component_of", "full_product_name" : { "name" : "rhcos-aarch64-416.94.202611031928-0 as a component of Red Hat OpenShift Container Platform 4.16", "product_id" : "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0" }, "product_reference" : "rhcos-aarch64-416.94.202611031928-0", "relates_to_product_reference" : "9Base-RHOSE-4.16" }, { "category" : "default_component_of", "full_product_name" : { "name" : "rhcos-ppc64le-416.94.202611031928-0 as a component of Red Hat OpenShift Container Platform 4.16", "product_id" : "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0" }, "product_reference" : "rhcos-ppc64le-416.94.202611031928-0", "relates_to_product_reference" : "9Base-RHOSE-4.16" }, { "category" : "default_component_of", "full_product_name" : { "name" : "rhcos-s390x-416.94.202611031928-0 as a component of Red Hat OpenShift Container Platform 4.16", "product_id" : "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0" }, "product_reference" : "rhcos-s390x-416.94.202611031928-0", "relates_to_product_reference" : "9Base-RHOSE-4.16" }, { "category" : "default_component_of", "full_product_name" : { "name" : "rhcos-x86_64-416.94.202611031928-0 as a component of Red Hat OpenShift Container Platform 4.16", "product_id" : "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" }, "product_reference" : "rhcos-x86_64-416.94.202611031928-0", "relates_to_product_reference" : "9Base-RHOSE-4.16" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2026-34182", "cwe" : { "id" : "CWE-130", "name" : "Improper Handling of Length Parameter Inconsistency" }, "discovery_date" : "2026-05-27T13:59:43+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2481884" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "Moderate: This flaw in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing could allow an on-path attacker to forge messages or bypass integrity validation. This is due to insufficient input validation on cipher and tag length fields, potentially leading to key-equivalent functionality or integrity bypass in applications utilizing affected OpenSSL versions for CMS AuthEnvelopedData.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-34182" }, { "category" : "external", "summary" : "RHBZ#2481884", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481884" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-34182", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-34182" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-34182", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-34182" } ], "release_date" : "2026-06-09T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "Systems configured to operate in FIPS mode are not affected by this vulnerability. To mitigate this issue, ensure that OpenSSL is operating in FIPS mode by enabling the system-wide FIPS policy. This may have broader implications for cryptographic operations on the system and should be evaluated for compatibility with existing applications. A system reboot may be required for the changes to take effect.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages" }, { "cve" : "CVE-2026-45445", "cwe" : { "id" : "CWE-1204", "name" : "Generation of Weak Initialization Vector (IV)" }, "discovery_date" : "2026-05-27T14:17:46+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2481896" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssl: AES-OCB IV Ignored on EVP_Cipher() Path", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This is a Moderate severity flaw where applications utilizing the AES-OCB cipher through OpenSSL's EVP_Cipher() one-shot interface may silently discard the provided initialization vector (IV). This leads to nonce reuse, compromising confidentiality and enabling universal forgery of authentication tags. Red Hat products are primarily affected if they include or rely on third-party applications that specifically employ this less common and discouraged API usage with AES-OCB, as standard OpenSSL SSL/TLS implementations and applications using the recommended streaming AEAD API are not impacted.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-45445" }, { "category" : "external", "summary" : "RHBZ#2481896", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481896" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-45445", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-45445" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45445", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45445" } ], "release_date" : "2026-06-09T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 9.1, "baseSeverity" : "CRITICAL", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "openssl: AES-OCB IV Ignored on EVP_Cipher() Path" }, { "cve" : "CVE-2026-59995", "cwe" : { "id" : "CWE-22", "name" : "Improper Limitation of a Pathname to a Restricted Directory" }, "discovery_date" : "2026-07-08T01:01:01.518880+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2497927" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssh: OpenSSH: sftp client allows attacker to control downloaded file location", "title" : "Vulnerability summary" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-59995" }, { "category" : "external", "summary" : "RHBZ#2497927", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497927" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-59995", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-59995" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59995", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59995" }, { "category" : "external", "summary" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2", "url" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2" }, { "category" : "external", "summary" : "https://www.openssh.org/releasenotes.html#10.4p1", "url" : "https://www.openssh.org/releasenotes.html#10.4p1" }, { "category" : "external", "summary" : "https://www.openwall.com/lists/oss-security/2026/07/06/5", "url" : "https://www.openwall.com/lists/oss-security/2026/07/06/5" } ], "release_date" : "2026-07-08T00:04:49.995000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "To mitigate this issue, avoid using the `sftp server:/path .` command when connecting to untrusted or potentially malicious SFTP servers. Exercise caution and verify the authenticity of SFTP servers before initiating file transfers, especially when using commands that implicitly define the download destination, and also avoid running SFTP sessions with elevated privileges (such as root).", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 5.4, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "REQUIRED", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "openssh: OpenSSH: sftp client allows attacker to control downloaded file location" }, { "cve" : "CVE-2026-59999", "cwe" : { "id" : "CWE-358", "name" : "Improperly Implemented Security Check for Standard" }, "discovery_date" : "2026-07-08T01:01:55.619428+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2497942" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This Moderate severity flaw in OpenSSH `sshd` allows `PermitTunnel=yes` to override `DisableForwarding=yes`, potentially bypassing intended security controls. In Red Hat environments where `DisableForwarding` is used to restrict SSH session capabilities, an attacker who compromises a user's session could still establish a tunnel, leading to unauthorized network access or data exfiltration. This bypass occurs even when administrators explicitly attempt to prevent forwarding, though `PermitTunnel` is not enabled by default.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-59999" }, { "category" : "external", "summary" : "RHBZ#2497942", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497942" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-59999", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-59999" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59999", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59999" }, { "category" : "external", "summary" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2", "url" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2" }, { "category" : "external", "summary" : "https://www.openssh.org/releasenotes.html#10.4p1", "url" : "https://www.openssh.org/releasenotes.html#10.4p1" }, { "category" : "external", "summary" : "https://www.openwall.com/lists/oss-security/2026/07/06/5", "url" : "https://www.openwall.com/lists/oss-security/2026/07/06/5" } ], "release_date" : "2026-07-08T00:13:08.397000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "To mitigate this issue, if `DisableForwarding=yes` is set in `/etc/ssh/sshd_config` to prevent all forwarding, ensure that `PermitTunnel` is explicitly set to `no` in the same configuration file. This will enforce the intended security policy.\n\nAfter modifying `/etc/ssh/sshd_config`, restart the `sshd` service for the changes to take effect. This may temporarily interrupt active SSH sessions.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options" }, { "cve" : "CVE-2026-60002", "cwe" : { "id" : "CWE-825", "name" : "Expired Pointer Dereference" }, "discovery_date" : "2026-07-08T01:01:33.808610+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2497936" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This Important flaw in OpenSSH client could allow a malicious SSH server to execute arbitrary code on the connecting client due to a use-after-free vulnerability during host key re-exchange. While requiring a connection to a specially crafted server, the potential for high impact on client confidentiality and integrity elevates the severity beyond Moderate.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-60002" }, { "category" : "external", "summary" : "RHBZ#2497936", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497936" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-60002", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-60002" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-60002", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-60002" }, { "category" : "external", "summary" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2", "url" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2" }, { "category" : "external", "summary" : "https://www.openssh.org/releasenotes.html#10.4p1", "url" : "https://www.openssh.org/releasenotes.html#10.4p1" }, { "category" : "external", "summary" : "https://www.openwall.com/lists/oss-security/2026/07/06/5", "url" : "https://www.openwall.com/lists/oss-security/2026/07/06/5" } ], "release_date" : "2026-07-08T00:17:33.058000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 7.7, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side" }, { "cve" : "CVE-2026-86145", "cwe" : { "id" : "CWE-787", "name" : "Out-of-bounds Write" }, "discovery_date" : "2026-09-05T05:20:54.676360+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2528993" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. This flaw is exploitable in Red Hat products when processing attacker-controlled regular expressions or when a recursive pattern is used in conjunction with a small, API-set heap limit, making it dependent on specific application usage patterns.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-86145" }, { "category" : "external", "summary" : "RHBZ#2528993", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2528993" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-86145", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-86145" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-86145" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "url" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "url" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf" } ], "release_date" : "2026-09-05T05:09:25.571000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 8.2, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions" }, { "cve" : "CVE-2026-89161", "cwe" : { "id" : "CWE-1341", "name" : "Multiple Releases of Same Resource or Handle" }, "discovery_date" : "2026-09-11T04:21:06.963234+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2531747" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This is an Important memory corruption vulnerability in PCRE2's JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-89161" }, { "category" : "external", "summary" : "RHBZ#2531747", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2531747" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-89161", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-89161" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89161" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/pull/937", "url" : "https://github.com/PCRE2Project/pcre2/pull/937" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "url" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "release_date" : "2026-09-11T04:11:51.666000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "LOCAL", "availabilityImpact" : "HIGH", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match" }, { "cve" : "CVE-2026-98432", "cwe" : { "id" : "CWE-825", "name" : "Expired Pointer Dereference" }, "discovery_date" : "2026-10-15T00:00:00+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2553390" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as Critical severity for Red Hat Enterprise Linux because it allows an unauthenticated remote attacker to cause kernel memory corruption or an immediate system crash over standard IPv4 TCP network traffic without requiring local privileges or user interaction. In default enterprise configurations across Red Hat environments, TCP services accept incoming connections without specialized tuning, making the concurrent connection handling paths inherently exposed to remote networks. Although reliably executing arbitrary code through this timing-sensitive use-after-free scenario requires precise heap control, the lack of network prerequisites and the potential for severe system instability elevate the impact above Important.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-98432" }, { "category" : "external", "summary" : "RHBZ#2553390", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553390" }, { "category" : "external", "summary" : "RHSB-2026-016", "url" : "https://access.redhat.com/security/vulnerabilities/RHSB-2026-016" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-98432", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-98432" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98432", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98432" }, { "category" : "external", "summary" : "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox", "url" : "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox" } ], "release_date" : "2026-10-15T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "See the security bulletin for a detailed mitigation procedure.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Critical" } ], "title" : "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period" }, { "cve" : "CVE-2026-103111", "cwe" : { "id" : "CWE-787", "name" : "Out-of-bounds Write" }, "discovery_date" : "2026-09-30T04:40:56.869940+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2543797" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-103111" }, { "category" : "external", "summary" : "RHBZ#2543797", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2543797" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-103111", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-103111" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-103111" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "url" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m" } ], "release_date" : "2026-09-30T04:13:59.115000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T01:58:04+00:00", "details" : "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:4eda35319bd4f1cf62676d74e2ca48c772e55114f81c373fc09d01f75f83b4ce\n\n (For s390x architecture)\n The image digest is sha256:e12d7cf01e5550b04ab451fc70a0e327ac4ed894a7c1d0ed6220b73c0c06bfff\n\n (For ppc64le architecture)\n The image digest is sha256:3de3edc1eeea830893554c5af1092821dbeb767ec6a3e23eefffb478d6515a39\n\n (For aarch64 architecture)\n The image digest is sha256:3968ebf80043423de593d2655e9e1382a6f5e54acd97bd0b214ce88d8837cc2b\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95229" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 7.6, "baseSeverity" : "HIGH", "confidentialityImpact" : "LOW", "integrityImpact" : "HIGH", "privilegesRequired" : "LOW", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-s390x-416.94.202611031928-0", "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202611031928-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression" } ] }