Red Hat
Monthly
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/form-data content to trigger premature parsing and disk storage of request data, leading to Denial of Service when applications use parameter retrieval methods like getParameterMap(). The vulnerability affects multiple Red Hat products including Enterprise Linux 8, 9, and 10, JBoss Enterprise Application Platform 7 and 8, Red Hat Fuse 7, and several Apache Camel variants. An attacker with network access and no authentication can exhaust server disk resources with moderate attack complexity, causing service unavailability.
A security vulnerability in An incomplete fix for CVE-2024-47778 (CVSS 5.1) that allows an out-of-bounds read. Remediation should follow standard vulnerability management procedures.
A specially crafted XCOFF object file can trigger an out-of-bounds memory read in the GNU Binutils BFD library due to improper validation of relocation type values. This affects Red Hat Enterprise Linux versions 6 through 10 and Red Hat OpenShift Container Platform 4, potentially allowing local attackers with user interaction to crash affected tools or disclose sensitive memory contents. While not currently listed in CISA KEV as actively exploited, the vulnerability is tracked across Red Hat, Sourceware, and Bugzilla with upstream references indicating visibility and likely patch development.
Keycloak contains an information disclosure vulnerability in the identity-first login flow when Organizations are enabled, where differential error messages allow remote attackers to enumerate valid user accounts without authentication. The vulnerability affects Red Hat Build of Keycloak across multiple versions, and while the CVSS score is low (3.7), the attack requires only network access with no user interaction. This user enumeration flaw could facilitate credential stuffing, phishing, or social engineering campaigns by confirming the existence of target accounts.
Keycloak's User-Managed Access endpoint fails to properly enforce access control on PUT operations, permitting authenticated attackers to modify protected resources despite the allowRemoteResourceManagement restriction being disabled. This access control bypass affects data integrity and impacts any organization using Keycloak for identity and access management. The vulnerability requires valid credentials to exploit and currently has no available patch.
A remote code execution vulnerability in A flaw (CVSS 5.8) that allows an attacker. Remediation should follow standard vulnerability management procedures.
Unauthenticated remote attackers can exhaust memory in Red Hat Build of Keycloak 26.4 and 26.4.10 by sending highly compressed SAML requests that bypass decompression size limits, triggering denial of service. The vulnerability affects SAML Redirect Binding implementations that fail to enforce resource constraints during DEFLATE decompression, allowing attackers to crash the application with OutOfMemoryError conditions. No patch is currently available.
SQL injection in the Katello plugin for Red Hat Satellite 6 allows authenticated remote attackers to execute arbitrary SQL commands via the sort_by parameter in the /api/hosts/bootc_images endpoint. An attacker can exploit this flaw to trigger database errors causing denial of service or conduct blind SQL injection attacks to extract sensitive information from the database. No patch is currently available for this vulnerability.
HTTP/2 server implementations in libsoup across Debian and Red Hat Enterprise Linux versions contain a use-after-free vulnerability that allows unauthenticated remote attackers to trigger application crashes through specially crafted requests. Exploitation results in denial of service by forcing the application to access freed memory, causing instability. No patch is currently available for this medium-severity flaw.
A security vulnerability in A flaw (CVSS 3.9). Remediation should follow standard vulnerability management procedures.
A flaw was found in libsoup, a library used by applications to send network requests.
A security vulnerability in A flaw (CVSS 3.9). Remediation should follow standard vulnerability management procedures.
High severity vulnerability in systemd. A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This al...
Medium severity vulnerability in systemd. A container privilege escalation flaw was found in certain Fuse images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the a...
Medium severity vulnerability in systemd. A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd f...
Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).
Namespace administrators on OpenShift clusters running the Red Hat OpenShift GitOps (Argo CD) operator prior to v1.16.2 can craft ArgoCD Custom Resources that coerce the operator into assigning permissions in other namespaces, including privileged ones. According to the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1), an authenticated attacker with namespace-admin rights can escalate from a single tenant namespace to cluster-wide root by creating privileged workloads scheduled onto master nodes; the scope change reflects the cross-namespace breakout. Exploitation requires prior namespace-admin privilege (PR:H), so multi-tenant shared clusters with semi-trusted tenants carry the real risk, while single-tenant environments where namespace admins are already trusted see limited added exposure; no public exploit identified at time of analysis and the EPSS score is only 0.69% (51st percentile), indicating low observed exploitation activity despite the high paper severity.
Privilege escalation in AMQ Broker container images lets an attacker who already has command execution as a member of the root group (GID 0) modify the group-writable /etc/passwd file and add a UID 0 account, yielding root inside the container. The flaw is a build-time permissions defect (CWE-276) confined to the container; it does not provide initial access, network reach, or a host escape. No public exploit was identified at time of analysis and EPSS is 0.21% (10th percentile), so risk is concentrated in environments where untrusted users can run commands in affected images built with this misconfiguration.
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/form-data content to trigger premature parsing and disk storage of request data, leading to Denial of Service when applications use parameter retrieval methods like getParameterMap(). The vulnerability affects multiple Red Hat products including Enterprise Linux 8, 9, and 10, JBoss Enterprise Application Platform 7 and 8, Red Hat Fuse 7, and several Apache Camel variants. An attacker with network access and no authentication can exhaust server disk resources with moderate attack complexity, causing service unavailability.
A security vulnerability in An incomplete fix for CVE-2024-47778 (CVSS 5.1) that allows an out-of-bounds read. Remediation should follow standard vulnerability management procedures.
A specially crafted XCOFF object file can trigger an out-of-bounds memory read in the GNU Binutils BFD library due to improper validation of relocation type values. This affects Red Hat Enterprise Linux versions 6 through 10 and Red Hat OpenShift Container Platform 4, potentially allowing local attackers with user interaction to crash affected tools or disclose sensitive memory contents. While not currently listed in CISA KEV as actively exploited, the vulnerability is tracked across Red Hat, Sourceware, and Bugzilla with upstream references indicating visibility and likely patch development.
Keycloak contains an information disclosure vulnerability in the identity-first login flow when Organizations are enabled, where differential error messages allow remote attackers to enumerate valid user accounts without authentication. The vulnerability affects Red Hat Build of Keycloak across multiple versions, and while the CVSS score is low (3.7), the attack requires only network access with no user interaction. This user enumeration flaw could facilitate credential stuffing, phishing, or social engineering campaigns by confirming the existence of target accounts.
Keycloak's User-Managed Access endpoint fails to properly enforce access control on PUT operations, permitting authenticated attackers to modify protected resources despite the allowRemoteResourceManagement restriction being disabled. This access control bypass affects data integrity and impacts any organization using Keycloak for identity and access management. The vulnerability requires valid credentials to exploit and currently has no available patch.
A remote code execution vulnerability in A flaw (CVSS 5.8) that allows an attacker. Remediation should follow standard vulnerability management procedures.
Unauthenticated remote attackers can exhaust memory in Red Hat Build of Keycloak 26.4 and 26.4.10 by sending highly compressed SAML requests that bypass decompression size limits, triggering denial of service. The vulnerability affects SAML Redirect Binding implementations that fail to enforce resource constraints during DEFLATE decompression, allowing attackers to crash the application with OutOfMemoryError conditions. No patch is currently available.
SQL injection in the Katello plugin for Red Hat Satellite 6 allows authenticated remote attackers to execute arbitrary SQL commands via the sort_by parameter in the /api/hosts/bootc_images endpoint. An attacker can exploit this flaw to trigger database errors causing denial of service or conduct blind SQL injection attacks to extract sensitive information from the database. No patch is currently available for this vulnerability.
HTTP/2 server implementations in libsoup across Debian and Red Hat Enterprise Linux versions contain a use-after-free vulnerability that allows unauthenticated remote attackers to trigger application crashes through specially crafted requests. Exploitation results in denial of service by forcing the application to access freed memory, causing instability. No patch is currently available for this medium-severity flaw.
A security vulnerability in A flaw (CVSS 3.9). Remediation should follow standard vulnerability management procedures.
A flaw was found in libsoup, a library used by applications to send network requests.
A security vulnerability in A flaw (CVSS 3.9). Remediation should follow standard vulnerability management procedures.
High severity vulnerability in systemd. A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This al...
Medium severity vulnerability in systemd. A container privilege escalation flaw was found in certain Fuse images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the a...
Medium severity vulnerability in systemd. A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd f...
Unbounded recursion in Nodemailer's address parser (npm package versions 3.0.0 through 7.0.10) allows a single crafted email address header to crash the Node.js process, causing a denial of service. Because nested RFC 5322 group syntax is not legal, the parser flattens nested groups by recursively re-invoking itself, and an attacker-controlled header containing many 'label:' colon tokens drives that recursion until the stack is exhausted and the runtime throws 'Maximum call stack size exceeded'. Exploitation requires no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but it only works where an application passes untrusted address strings into the parser; publicly available exploit code exists, EPSS is low at 0.56% (44th percentile), and there is no confirmed active exploitation (no CISA KEV listing).
Namespace administrators on OpenShift clusters running the Red Hat OpenShift GitOps (Argo CD) operator prior to v1.16.2 can craft ArgoCD Custom Resources that coerce the operator into assigning permissions in other namespaces, including privileged ones. According to the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1), an authenticated attacker with namespace-admin rights can escalate from a single tenant namespace to cluster-wide root by creating privileged workloads scheduled onto master nodes; the scope change reflects the cross-namespace breakout. Exploitation requires prior namespace-admin privilege (PR:H), so multi-tenant shared clusters with semi-trusted tenants carry the real risk, while single-tenant environments where namespace admins are already trusted see limited added exposure; no public exploit identified at time of analysis and the EPSS score is only 0.69% (51st percentile), indicating low observed exploitation activity despite the high paper severity.
Privilege escalation in AMQ Broker container images lets an attacker who already has command execution as a member of the root group (GID 0) modify the group-writable /etc/passwd file and add a UID 0 account, yielding root inside the container. The flaw is a build-time permissions defect (CWE-276) confined to the container; it does not provide initial access, network reach, or a host escape. No public exploit was identified at time of analysis and EPSS is 0.21% (10th percentile), so risk is concentrated in environments where untrusted users can run commands in affected images built with this misconfiguration.