{ "document" : { "aggregate_severity" : { "namespace" : "https://access.redhat.com/security/updates/classification/", "text" : "Critical" }, "category" : "csaf_security_advisory", "csaf_version" : "2.0", "distribution" : { "text" : "Copyright © Red Hat, Inc. All rights reserved.", "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "en", "notes" : [ { "category" : "summary", "text" : "Red Hat OpenShift Container Platform release 4.14.78 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.14.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title" : "Topic" }, { "category" : "general", "text" : "Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.14.78. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHSA-2026:95507\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nSecurity Fix(es):\n\n* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)\n* openssl: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)\n* openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)\n* openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)\n* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)\n* kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n* setuptools: Path Traversal Vulnerability in setuptools PackageIndex (CVE-2025-47273)\n* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)\n* openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages (CVE-2026-34182)\n* gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011)\n* gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013)\n* openssl: AES-OCB IV Ignored on EVP_Cipher() Path (CVE-2026-45445)\n* openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)\n* kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "title" : "Details" }, { "category" : "legal_disclaimer", "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title" : "Terms of Use" } ], "publisher" : { "category" : "vendor", "contact_details" : "https://access.redhat.com/security/team/contact/", "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name" : "Red Hat Product Security", "namespace" : "https://www.redhat.com" }, "references" : [ { "category" : "self", "summary" : "https://access.redhat.com/errata/RHSA-2026:95508", "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "external", "summary" : "https://access.redhat.com/security/updates/classification/#critical", "url" : "https://access.redhat.com/security/updates/classification/#critical" }, { "category" : "external", "summary" : "2366982", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2366982" }, { "category" : "external", "summary" : "2456314", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2456314" }, { "category" : "external", "summary" : "2467437", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2467437" }, { "category" : "external", "summary" : "2467448", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2467448" }, { "category" : "external", "summary" : "2481884", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481884" }, { "category" : "external", "summary" : "2481896", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481896" }, { "category" : "external", "summary" : "2481898", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "category" : "external", "summary" : "2497927", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497927" }, { "category" : "external", "summary" : "2497936", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497936" }, { "category" : "external", "summary" : "2497942", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497942" }, { "category" : "external", "summary" : "2502845", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2502845" }, { "category" : "external", "summary" : "2528542", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2528542" }, { "category" : "external", "summary" : "2535391", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2535391" }, { "category" : "external", "summary" : "2553390", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553390" }, { "category" : "external", "summary" : "2558973", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2558973" }, { "category" : "self", "summary" : "Canonical URL", "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95508.json" } ], "title" : "Red Hat Security Advisory: OpenShift Container Platform 4.14.78 bug fix and security update", "tracking" : { "current_release_date" : "2026-11-09T17:56:46+00:00", "generator" : { "date" : "2026-11-09T17:56:46+00:00", "engine" : { "name" : "Red Hat SDEngine", "version" : "5.4.5" } }, "id" : "RHSA-2026:95508", "initial_release_date" : "2026-11-09T17:10:46+00:00", "revision_history" : [ { "date" : "2026-11-09T17:10:46+00:00", "number" : "1", "summary" : "Initial version" }, { "date" : "2026-11-09T17:10:46+00:00", "number" : "2", "summary" : "Last updated version" }, { "date" : "2026-11-09T17:56:46+00:00", "number" : "3", "summary" : "Last generated version" } ], "status" : "final", "version" : "3" } }, "product_tree" : { "branches" : [ { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Red Hat OpenShift Container Platform 4.14", "product" : { "name" : "Red Hat OpenShift Container Platform 4.14", "product_id" : "9Base-RHOSE-4.14", "product_identification_helper" : { "cpe" : "cpe:/a:redhat:openshift:4.14::el9" } } } ], "category" : "product_family", "name" : "Red Hat OpenShift Enterprise" }, { "branches" : [ { "category" : "product_version", "name" : "rhcos-aarch64-414.92.202611040941-0", "product" : { "name" : "rhcos-aarch64-414.92.202611040941-0", "product_id" : "rhcos-aarch64-414.92.202611040941-0", "product_identification_helper" : { "purl" : "pkg:generic/redhat/rhcos@414.92.202611040941?arch=aarch64" } } } ], "category" : "architecture", "name" : "aarch64" }, { "branches" : [ { "category" : "product_version", "name" : "rhcos-ppc64le-414.92.202611040941-0", "product" : { "name" : "rhcos-ppc64le-414.92.202611040941-0", "product_id" : "rhcos-ppc64le-414.92.202611040941-0", "product_identification_helper" : { "purl" : "pkg:generic/redhat/rhcos@414.92.202611040941?arch=ppc64le" } } } ], "category" : "architecture", "name" : "ppc64le" }, { "branches" : [ { "category" : "product_version", "name" : "rhcos-s390x-414.92.202611040941-0", "product" : { "name" : "rhcos-s390x-414.92.202611040941-0", "product_id" : "rhcos-s390x-414.92.202611040941-0", "product_identification_helper" : { "purl" : "pkg:generic/redhat/rhcos@414.92.202611040941?arch=s390x" } } } ], "category" : "architecture", "name" : "s390x" }, { "branches" : [ { "category" : "product_version", "name" : "rhcos-x86_64-414.92.202611040941-0", "product" : { "name" : "rhcos-x86_64-414.92.202611040941-0", "product_id" : "rhcos-x86_64-414.92.202611040941-0", "product_identification_helper" : { "purl" : "pkg:generic/redhat/rhcos@414.92.202611040941?arch=x86_64" } } } ], "category" : "architecture", "name" : "x86_64" } ], "category" : "vendor", "name" : "Red Hat" } ], "relationships" : [ { "category" : "default_component_of", "full_product_name" : { "name" : "rhcos-aarch64-414.92.202611040941-0 as a component of Red Hat OpenShift Container Platform 4.14", "product_id" : "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0" }, "product_reference" : "rhcos-aarch64-414.92.202611040941-0", "relates_to_product_reference" : "9Base-RHOSE-4.14" }, { "category" : "default_component_of", "full_product_name" : { "name" : "rhcos-ppc64le-414.92.202611040941-0 as a component of Red Hat OpenShift Container Platform 4.14", "product_id" : "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0" }, "product_reference" : "rhcos-ppc64le-414.92.202611040941-0", "relates_to_product_reference" : "9Base-RHOSE-4.14" }, { "category" : "default_component_of", "full_product_name" : { "name" : "rhcos-s390x-414.92.202611040941-0 as a component of Red Hat OpenShift Container Platform 4.14", "product_id" : "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0" }, "product_reference" : "rhcos-s390x-414.92.202611040941-0", "relates_to_product_reference" : "9Base-RHOSE-4.14" }, { "category" : "default_component_of", "full_product_name" : { "name" : "rhcos-x86_64-414.92.202611040941-0 as a component of Red Hat OpenShift Container Platform 4.14", "product_id" : "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" }, "product_reference" : "rhcos-x86_64-414.92.202611040941-0", "relates_to_product_reference" : "9Base-RHOSE-4.14" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2025-47273", "cwe" : { "id" : "CWE-22", "name" : "Improper Limitation of a Pathname to a Restricted Directory" }, "discovery_date" : "2025-05-17T16:00:41.145177+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2366982" } ], "notes" : [ { "category" : "description", "text" : "A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of important system files, creating opportunities for further compromise. While it doesn't expose data or require user interaction, it poses a high integrity risk and is especially concerning in environments that rely on automated package handling or internal tooling built on setuptools.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "setuptools: Path Traversal Vulnerability in setuptools PackageIndex", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "Red Hat Product Security has rated this vulnerability \"Moderate\" based on the impact of the damage caused by a successful exploitation and the pre-requisites.\n\n* Exploitation requires that the attacker have limited code execution access to a Python environment where they can trigger the vulnerable PackageIndex.download() function—this might be via a script, plugin, or automated job. Full admin rights aren't needed but a user with no access at all will be unable to exploit this vulnerability.\n* The vulnerability impacts the integrity of the system within the same security boundary—it does not enable access or compromise across trust boundaries (e.g., from one container to another or from user space to kernel).\n* Successful exploitation only allows the attacker to \"create\" new files. The vulnerability does not provide access to existing files and by an extension to any confidential information. \n* Arbitrary file writes can overwrite critical config files, executables, or scripts. This can lead to persistent code execution, system misconfiguration, or unauthorized behavior, especially in automated environments. While overwriting critical files could theoretically lead to service disruption, the vulnerability in isolation does not inherently cause denial of service. The exploit doesn't target availability directly, and in many cases, systems may continue running.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2025-47273" }, { "category" : "external", "summary" : "RHBZ#2366982", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2366982" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2025-47273", "url" : "https://www.cve.org/CVERecord?id=CVE-2025-47273" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2025-47273", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-47273" }, { "category" : "external", "summary" : "https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88", "url" : "https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88" }, { "category" : "external", "summary" : "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b", "url" : "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b" }, { "category" : "external", "summary" : "https://github.com/pypa/setuptools/issues/4946", "url" : "https://github.com/pypa/setuptools/issues/4946" }, { "category" : "external", "summary" : "https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf", "url" : "https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf" } ], "release_date" : "2025-05-17T15:46:11.399000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 7.1, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "privilegesRequired" : "LOW", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "setuptools: Path Traversal Vulnerability in setuptools PackageIndex" }, { "acknowledgments" : [ { "names" : [ "Shaomin Chen" ], "summary" : "Acknowledged by upstream." } ], "cve" : "CVE-2026-16313", "cwe" : { "id" : "CWE-93", "name" : "Improper Neutralization of CRLF Sequences" }, "discovery_date" : "2026-06-01T18:13:24+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2502845" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "sg3_utils versions 1.34 through 1.48 contain a command injection flaw in the export_dev_ids() function of sg_inq. When sg_inq --export processes SCSI device identification data from VPD page 0x83, the SCSI name string designator (type 8) and the ATA vendor-ID subfield are printed without sanitizing embedded control characters. A crafted SCSI/USB device can embed a newline in this field, splitting sg_inq's udev KEY=VALUE output into two lines and injecting an arbitrary udev property, including REMOVE_CMD. On systems whose default udev rules invoke sg_inq --export for SCSI device identification and act on REMOVE_CMD when a device is removed, this allows a local attacker with physical access to a USB/SCSI port to achieve arbitrary command execution as root simply by disconnecting the crafted device.\n\nExploitation requires physical access to attach the malicious device, consistent with Red Hat's Physical (AV:P) attack vector scoring. The upstream fix (udev-conforming character escaping for this field) has not yet been included in any tagged sg3_utils release; all Red Hat-shipped versions of sg3_utils in the 1.34-1.48 range are affected.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-16313" }, { "category" : "external", "summary" : "RHBZ#2502845", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2502845" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-16313", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-16313" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-16313", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-16313" }, { "category" : "external", "summary" : "https://github.com/doug-gilbert/sg3_utils/pull/83", "url" : "https://github.com/doug-gilbert/sg3_utils/pull/83" } ], "release_date" : "2026-06-01T18:13:24+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "Remove or comment out the REMOVE_CMD rule from 50-udev-default.rules to prevent command execution on device removal. Alternatively, if automatic SCSI device identification is not required, disable the udev rule that invokes sg_inq --export on device connection.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "PHYSICAL", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "CHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export" }, { "cve" : "CVE-2026-28390", "cwe" : { "id" : "CWE-476", "name" : "NULL Pointer Dereference" }, "discovery_date" : "2026-04-07T23:01:18.313921+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2456314" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSL. A remote attacker could exploit this vulnerability by sending a specially crafted Cryptographic Message Syntax (CMS) EnvelopedData message. During the processing of a KeyTransportRecipientInfo with RSA-OAEP encryption, the system attempts to access an optional parameter field without first verifying its presence. This leads to a NULL pointer dereference, which can cause applications processing the attacker-controlled CMS data to crash, resulting in a Denial of Service (DoS).", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This CVE has been rated as moderate by redhat because the vulnerability is limited to a denial-of-service condition caused by a NULL pointer dereference in OpenSSL CMS processing, without evidence of memory corruption or code execution, furthermore the Affected functionality is niche. The vulnerable path requires:\nCMS/S/MIME processing,\nspecifically CMS_decrypt(),\nwith RSA-OAEP KeyTransportRecipientInfo.\nMany OpenSSL consumers never use CMS APIs, never process S/MIME,\nor do not decrypt attacker-controlled CMS objects.\nSo exposure is far narrower than a generic TLS parsing vulnerability.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-28390" }, { "category" : "external", "summary" : "RHBZ#2456314", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2456314" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-28390", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-28390" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28390", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-28390" }, { "category" : "external", "summary" : "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc", "url" : "https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc" }, { "category" : "external", "summary" : "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6", "url" : "https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6" }, { "category" : "external", "summary" : "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4", "url" : "https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4" }, { "category" : "external", "summary" : "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788", "url" : "https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788" }, { "category" : "external", "summary" : "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75", "url" : "https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75" }, { "category" : "external", "summary" : "https://openssl-library.org/news/secadv/20260407.txt", "url" : "https://openssl-library.org/news/secadv/20260407.txt" } ], "release_date" : "2026-04-07T22:00:54.172000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing" }, { "cve" : "CVE-2026-34182", "cwe" : { "id" : "CWE-130", "name" : "Improper Handling of Length Parameter Inconsistency" }, "discovery_date" : "2026-05-27T13:59:43+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2481884" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity validation. Consequently, an attacker may achieve key-equivalent functionality for a given CMS recipient.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "Moderate: This flaw in OpenSSL's Cryptographic Message Services (CMS) AuthEnvelopedData processing could allow an on-path attacker to forge messages or bypass integrity validation. This is due to insufficient input validation on cipher and tag length fields, potentially leading to key-equivalent functionality or integrity bypass in applications utilizing affected OpenSSL versions for CMS AuthEnvelopedData.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-34182" }, { "category" : "external", "summary" : "RHBZ#2481884", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481884" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-34182", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-34182" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-34182", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-34182" } ], "release_date" : "2026-06-09T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "Systems configured to operate in FIPS mode are not affected by this vulnerability. To mitigate this issue, ensure that OpenSSL is operating in FIPS mode by enabling the system-wide FIPS policy. This may have broader implications for cryptographic operations on the system and should be evaluated for compatibility with existing applications. A system reboot may be required for the changes to take effect.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages" }, { "acknowledgments" : [ { "names" : [ "Haruto Kimura" ], "organization" : "Stella" } ], "cve" : "CVE-2026-42011", "cwe" : { "id" : "CWE-295", "name" : "Improper Certificate Validation" }, "discovery_date" : "2026-05-06T19:06:25.319000+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2467437" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "gnutls: gnutls: Security bypass due to incorrect name constraint handling", "title" : "Vulnerability summary" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-42011" }, { "category" : "external", "summary" : "RHBZ#2467437", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2467437" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-42011", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-42011" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42011", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42011" }, { "category" : "external", "summary" : "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6", "url" : "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6" } ], "release_date" : "2026-04-29T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "gnutls: gnutls: Security bypass due to incorrect name constraint handling" }, { "acknowledgments" : [ { "names" : [ "Haruto Kimura" ], "organization" : "Stella" }, { "names" : [ "Joshua Rogers" ], "organization" : "AISLE Research Team" } ], "cve" : "CVE-2026-42013", "cwe" : { "id" : "CWE-295", "name" : "Improper Certificate Validation" }, "discovery_date" : "2026-05-06T19:47:00.134000+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2467448" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as having a Moderate impact across affected Red Hat products because successful exploitation requires an active man-in-the-middle network position as well as a certificate issued by a trusted authority matching the target hostname's Common Name. Although TLS clients using GnuTLS on Red Hat Enterprise Linux and OpenShift are susceptible to improper certificate acceptance under these conditions, modern certificate authorities rarely issue certificates that omit valid Subject Alternative Names, substantially restricting practical threat vectors. Applications functioning exclusively as TLS servers or utilizing alternative cryptographic libraries like OpenSSL are not exposed to this flaw.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-42013" }, { "category" : "external", "summary" : "RHBZ#2467448", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2467448" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-42013", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-42013" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42013", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-42013" }, { "category" : "external", "summary" : "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8", "url" : "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8" } ], "release_date" : "2026-04-29T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 8.2, "baseSeverity" : "HIGH", "confidentialityImpact" : "LOW", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name" }, { "cve" : "CVE-2026-45445", "cwe" : { "id" : "CWE-1204", "name" : "Generation of Weak Initialization Vector (IV)" }, "discovery_date" : "2026-05-27T14:17:46+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2481896" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSL. Applications that use the AES-OCB encryption method with a specific one-shot interface (EVP_Cipher()) will have their provided Initialization Vector (IV) silently discarded. This leads to the same internal cryptographic value being used repeatedly, which compromises the confidentiality of encrypted data. Additionally, this issue allows for the universal forgery of authentication tags, undermining the integrity of communications.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssl: AES-OCB IV Ignored on EVP_Cipher() Path", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This is a Moderate severity flaw where applications utilizing the AES-OCB cipher through OpenSSL's EVP_Cipher() one-shot interface may silently discard the provided initialization vector (IV). This leads to nonce reuse, compromising confidentiality and enabling universal forgery of authentication tags. Red Hat products are primarily affected if they include or rely on third-party applications that specifically employ this less common and discouraged API usage with AES-OCB, as standard OpenSSL SSL/TLS implementations and applications using the recommended streaming AEAD API are not impacted.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-45445" }, { "category" : "external", "summary" : "RHBZ#2481896", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481896" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-45445", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-45445" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45445", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45445" } ], "release_date" : "2026-06-09T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 9.1, "baseSeverity" : "CRITICAL", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "openssl: AES-OCB IV Ignored on EVP_Cipher() Path" }, { "cve" : "CVE-2026-45447", "cwe" : { "id" : "CWE-825", "name" : "Expired Pointer Dereference" }, "discovery_date" : "2026-05-27T14:17:46+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2481898" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSL. When processing a specially crafted PKCS#7 or S/MIME (Secure/Multipurpose Internet Mail Extensions) signed message, a heap use-after-free vulnerability in the PKCS7_verify() function can be triggered. This occurs if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, leading to incorrect memory deallocation. A remote attacker could exploit this to cause application crashes, memory corruption, or potentially achieve remote code execution.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This High severity heap use-after-free flaw in OpenSSL's PKCS7_verify() function can be triggered by processing a specially crafted PKCS#7 or S/MIME signed message. This could lead to application crashes, memory corruption, or potentially remote code execution, impacting services that handle such messages. The vulnerability specifically affects applications utilizing OpenSSL PKCS#7 APIs, while those using CMS APIs are not impacted.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-45447" }, { "category" : "external", "summary" : "RHBZ#2481898", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481898" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-45447", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-45447" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45447", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45447" } ], "release_date" : "2026-06-09T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()" }, { "cve" : "CVE-2026-59995", "cwe" : { "id" : "CWE-22", "name" : "Improper Limitation of a Pathname to a Restricted Directory" }, "discovery_date" : "2026-07-08T01:01:01.518880+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2497927" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssh: OpenSSH: sftp client allows attacker to control downloaded file location", "title" : "Vulnerability summary" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-59995" }, { "category" : "external", "summary" : "RHBZ#2497927", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497927" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-59995", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-59995" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59995", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59995" }, { "category" : "external", "summary" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2", "url" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2" }, { "category" : "external", "summary" : "https://www.openssh.org/releasenotes.html#10.4p1", "url" : "https://www.openssh.org/releasenotes.html#10.4p1" }, { "category" : "external", "summary" : "https://www.openwall.com/lists/oss-security/2026/07/06/5", "url" : "https://www.openwall.com/lists/oss-security/2026/07/06/5" } ], "release_date" : "2026-07-08T00:04:49.995000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "To mitigate this issue, avoid using the `sftp server:/path .` command when connecting to untrusted or potentially malicious SFTP servers. Exercise caution and verify the authenticity of SFTP servers before initiating file transfers, especially when using commands that implicitly define the download destination, and also avoid running SFTP sessions with elevated privileges (such as root).", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 5.4, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "REQUIRED", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "openssh: OpenSSH: sftp client allows attacker to control downloaded file location" }, { "cve" : "CVE-2026-59999", "cwe" : { "id" : "CWE-358", "name" : "Improperly Implemented Security Check for Standard" }, "discovery_date" : "2026-07-08T01:01:55.619428+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2497942" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This Moderate severity flaw in OpenSSH `sshd` allows `PermitTunnel=yes` to override `DisableForwarding=yes`, potentially bypassing intended security controls. In Red Hat environments where `DisableForwarding` is used to restrict SSH session capabilities, an attacker who compromises a user's session could still establish a tunnel, leading to unauthorized network access or data exfiltration. This bypass occurs even when administrators explicitly attempt to prevent forwarding, though `PermitTunnel` is not enabled by default.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-59999" }, { "category" : "external", "summary" : "RHBZ#2497942", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497942" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-59999", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-59999" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59999", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-59999" }, { "category" : "external", "summary" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2", "url" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2" }, { "category" : "external", "summary" : "https://www.openssh.org/releasenotes.html#10.4p1", "url" : "https://www.openssh.org/releasenotes.html#10.4p1" }, { "category" : "external", "summary" : "https://www.openwall.com/lists/oss-security/2026/07/06/5", "url" : "https://www.openwall.com/lists/oss-security/2026/07/06/5" } ], "release_date" : "2026-07-08T00:13:08.397000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "To mitigate this issue, if `DisableForwarding=yes` is set in `/etc/ssh/sshd_config` to prevent all forwarding, ensure that `PermitTunnel` is explicitly set to `no` in the same configuration file. This will enforce the intended security policy.\n\nAfter modifying `/etc/ssh/sshd_config`, restart the `sshd` service for the changes to take effect. This may temporarily interrupt active SSH sessions.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options" }, { "cve" : "CVE-2026-60002", "cwe" : { "id" : "CWE-825", "name" : "Expired Pointer Dereference" }, "discovery_date" : "2026-07-08T01:01:33.808610+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2497936" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This Important flaw in OpenSSH client could allow a malicious SSH server to execute arbitrary code on the connecting client due to a use-after-free vulnerability during host key re-exchange. While requiring a connection to a specially crafted server, the potential for high impact on client confidentiality and integrity elevates the severity beyond Moderate.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-60002" }, { "category" : "external", "summary" : "RHBZ#2497936", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2497936" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-60002", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-60002" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-60002", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-60002" }, { "category" : "external", "summary" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2", "url" : "https://marc.info/?l=openssh-unix-dev&m=178333966933090&w=2" }, { "category" : "external", "summary" : "https://www.openssh.org/releasenotes.html#10.4p1", "url" : "https://www.openssh.org/releasenotes.html#10.4p1" }, { "category" : "external", "summary" : "https://www.openwall.com/lists/oss-security/2026/07/06/5", "url" : "https://www.openwall.com/lists/oss-security/2026/07/06/5" } ], "release_date" : "2026-07-08T00:17:33.058000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 7.7, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side" }, { "cve" : "CVE-2026-80792", "cwe" : { "id" : "CWE-825", "name" : "Expired Pointer Dereference" }, "discovery_date" : "2026-09-04T00:00:00+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2528542" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive kernel data, misdirect network traffic, or cause a system crash (Denial of Service).", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "kernel: ipv6: fix use-after-free in ip6_finish_output2()", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as Important severity because successful exploitation allows a local user to leverage a use-after-free condition during lightweight tunnel transmission, potentially compromising system stability, leaking sensitive kernel memory, or tampering with network routing tables. Systems running Red Hat Enterprise Linux 9 and 10 or OpenShift Container Platform are affected when IPv6 network traffic undergoes lightweight tunnel encapsulation or BPF transit actions. Earlier releases including Red Hat Enterprise Linux 7 and 8 do not incorporate the vulnerable networking logic and are not affected.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-80792" }, { "category" : "external", "summary" : "RHBZ#2528542", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2528542" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-80792", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-80792" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80792", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80792" }, { "category" : "external", "summary" : "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox", "url" : "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox" } ], "release_date" : "2026-09-04T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "LOCAL", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "LOW", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "kernel: ipv6: fix use-after-free in ip6_finish_output2()" }, { "cve" : "CVE-2026-89846", "cwe" : { "id" : "CWE-125", "name" : "Out-of-bounds Read" }, "discovery_date" : "2026-09-16T00:00:00+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2535391" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in the Linux kernel's `scsi: qla2xxx` driver. A remote attacker, by sending a specially crafted Fibre Channel Protocol (FCP) response, could cause an integer underflow. This underflow leads to an out-of-bounds read when handling sense data, potentially disclosing sensitive memory information from the kernel's heap.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as having Important impact because a malicious or compromised Fibre Channel target can trigger an out-of-bounds read in the kernel, leading to kernel memory disclosure or denial of service. Exploitation is constrained to systems equipped with QLogic Fibre Channel host bus adapters utilizing the qla2xxx driver connected to an untrusted storage fabric. Systems lacking this specific storage hardware or operating within isolated, trusted storage networks are not exposed to untrusted FCP responses.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-89846" }, { "category" : "external", "summary" : "RHBZ#2535391", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2535391" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-89846", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-89846" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89846", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89846" }, { "category" : "external", "summary" : "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89846.mbox", "url" : "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89846.mbox" } ], "release_date" : "2026-09-16T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "If QLogic Fibre Channel HBAs are not in use, the 'qla2xxx' kernel module can be blacklisted to prevent it from loading. This can be achieved by creating a modprobe configuration file.\n\nTo blacklist the module:\n1. Create a file named `/etc/modprobe.d/blacklist-qla2xxx.conf` with the following content:\n `blacklist qla2xxx`\n2. Regenerate the initramfs to ensure the blacklist is applied during boot:\n `sudo dracut -f -v` (for RHEL 7/8/9)\n `sudo mkinitcpio -P` (for Arch-based systems, if applicable)\n3. Reboot the system for the changes to take effect.\n\nWarning: Blacklisting this module will disable functionality for QLogic Fibre Channel HBAs. Ensure that this hardware is not required before applying this mitigation. A system reboot is required for the changes to take effect.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "LOCAL", "availabilityImpact" : "HIGH", "baseScore" : 7.1, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "privilegesRequired" : "LOW", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read" }, { "cve" : "CVE-2026-98432", "cwe" : { "id" : "CWE-825", "name" : "Expired Pointer Dereference" }, "discovery_date" : "2026-10-15T00:00:00+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2553390" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as Critical severity for Red Hat Enterprise Linux because it allows an unauthenticated remote attacker to cause kernel memory corruption or an immediate system crash over standard IPv4 TCP network traffic without requiring local privileges or user interaction. In default enterprise configurations across Red Hat environments, TCP services accept incoming connections without specialized tuning, making the concurrent connection handling paths inherently exposed to remote networks. Although reliably executing arbitrary code through this timing-sensitive use-after-free scenario requires precise heap control, the lack of network prerequisites and the potential for severe system instability elevate the impact above Important.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-98432" }, { "category" : "external", "summary" : "RHBZ#2553390", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2553390" }, { "category" : "external", "summary" : "RHSB-2026-016", "url" : "https://access.redhat.com/security/vulnerabilities/RHSB-2026-016" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-98432", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-98432" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98432", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98432" }, { "category" : "external", "summary" : "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox", "url" : "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox" } ], "release_date" : "2026-10-15T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "See the security bulletin for a detailed mitigation procedure.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "impact", "details" : "Critical" } ], "title" : "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period" }, { "cve" : "CVE-2026-111497", "cwe" : { "id" : "CWE-787", "name" : "Out-of-bounds Write" }, "discovery_date" : "2026-10-22T13:42:58.596140+00:00", "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2558973" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "brotli: Out-of-Bounds Write in Google Brotli Decoder", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This issue is rated Important. Exploitation requires that the target decompress attacker-controlled Brotli data (for example HTTP content negotiated with Content-Encoding: br, or APIs such as Node.js zlib / fetch() that decode Brotli). The vulnerable path is reached with a malformed stream rather than typical well-formed encoder output. Red Hat Enterprise Linux compiler and runtime hardenings - including Address Space Layout Randomization (ASLR), Non-eXecutable (NX) memory, FORTIFY_SOURCE, and SELinux - increase the difficulty of turning this memory corruption into reliable code execution, though they do not eliminate crashes or all impact. Combined with the Attack Requirements noted by the CNA (CVSS v4 AT:P), Red Hat scores Attack Complexity as High and rates the flaw Important rather than Critical.\n\n---\n\nThe Node.js packages in Red Hat Enterprise Linux use either system version of brotli or bundled version. Some Node.js versions are marked \"Not affected\" because they utilize system brotli. For these versions, the Node.js package itself does not require updating. However, customers must still update the system brotli/libbrotli package to address the vulnerability for these Node.js installations.\n\nFollowing is the overview of Node.js versions use system or bundled version.\n\n- Node.js 22 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:22 module, uses system brotli.\n- Node.js 24 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:24 modules, use bundled brotli.\n- Node.js 22 and 24 in Red Hat Enterprise Linux 10, provided via nodejs22 and nodejs24 use system brotli.\n\n---\n\nThe .NET packages in Red Hat Enterprise Linux may either use system version of brotli or bundled version. Following is the overview of .NET versions use system or bundled version.\n\n- .NET 8.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet8.0 packages, use bundled brotli.\n- .NET 9.0, 10.0, and 11.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet9.0, dotnet10.0, and dotnet11.0 packages, use system brotli.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-111497" }, { "category" : "external", "summary" : "RHBZ#2558973", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2558973" }, { "category" : "external", "summary" : "RHSB-2026-015", "url" : "https://access.redhat.com/security/vulnerabilities/RHSB-2026-015" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-111497", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-111497" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-111497", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-111497" }, { "category" : "external", "summary" : "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high", "url" : "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high" }, { "category" : "external", "summary" : "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url" : "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date" : "2026-10-22T13:35:41.975000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-09T17:10:46+00:00", "details" : "For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3141b63f379bfbc8f19ea61ae23532199efe2cc90740fb22ff5b67c808557968\n\n (For s390x architecture)\n The image digest is sha256:6ead21766e93bd4365be9b11e0d7d3b61706da78075fd20307568dfe1790318c\n\n (For ppc64le architecture)\n The image digest is sha256:33fd2434da5abcfae6de499092569fb159c9a29efbf8ddc9f5e87a67a5e8880a\n\n (For aarch64 architecture)\n The image digest is sha256:f0a1a76229b14f928ad7c5600f26062c32dd8d01806f893c5ba492a9b3c45cc8\n\nAll OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.14/html-single/updating_clusters/index#updating-cluster-cli.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95508" }, { "category" : "workaround", "details" : "See the security bulletin for a detailed mitigation procedure.", "product_ids" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version" : "3.1" }, "products" : [ "9Base-RHOSE-4.14:rhcos-aarch64-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-ppc64le-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-s390x-414.92.202611040941-0", "9Base-RHOSE-4.14:rhcos-x86_64-414.92.202611040941-0" ] } ], "threats" : [ { "category" : "exploit_status", "date" : "2026-10-27T00:00:00+00:00", "details" : "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category" : "impact", "details" : "Important" } ], "title" : "brotli: Out-of-Bounds Write in Google Brotli Decoder" } ] }