rhui 5 Schwachstellen (CVE)

6.8Mittel

CVE-2026-114406 vor 15 Tagen

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certif…

8.8Hoch

CVE-2026-89091 vor 28 Tagen

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

Red Hat Migration Toolkit for Applications 8; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Service Mesh 3; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), an…

5.0Mittel

CVE-2026-103870 vor 29 Tagen

Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

Red Hat Red Hat Satellite 6; Red Hat Red Hat Update Infrastructure 4 for Cloud Providers; Red Hat Red Hat Update Infrastructure 5

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write…

6.5Mittel

CVE-2026-103868 vor 29 Tagen

Pulp-container: registry credentials are reused across remotes in a worker

Red Hat Red Hat Ansible Automation Platform 2; Red Hat Red Hat Satellite 6; Red Hat Red Hat Update Infrastructure 4 for Cloud Providers; Red Hat Red Hat Update Infrastructure 5

A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server the…

8.1Hoch

CVE-2026-90959 vor 1 Monat

Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft

Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6; Red Hat Red Hat Ansible Automation Platform 2.7; Red Hat Red Hat Ansible Automation Platform 2

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a stri…

7.8Hoch

CVE-2026-96512 vor 1 Monat

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Bec…

8.5Hoch

CVE-2026-74860 vor 1 Monat

Libxml2: double-free/uaf in libxml2 python bindings

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-fre…

5.4Mittel

CVE-2026-84232 vor 2 Monaten

Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content

Red Hat Red Hat Ansible Automation Platform 2; Red Hat Red Hat Satellite 6; Red Hat Red Hat Update Infrastructure 4 for Cloud Providers; Red Hat Red Hat Update Infrastructure 5

A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type repositories are served with their original content type (e.g., text/html for .html files, image/svg+xml for .svg files) and without a Content-Disposition: attachment…

7.0Hoch

CVE-2026-13732 vor 2 Monaten

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Cost Management On-Premise 1

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destru…

7.5Hoch

CVE-2026-78002 vor 2 Monaten

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation durin…

1.1%EPSS

7.5Hoch

CVE-2026-19654 vor 2 Monaten

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity …

4.4Mittel

CVE-2026-18477 vor 3 Monaten

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Discovery 2

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where th…

4.4Mittel

CVE-2026-18508 vor 3 Monaten

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Discovery 2

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlin…

5.5Mittel

CVE-2026-16730 vor 3 Monaten

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Update Infrastructure 5; Red Hat Red Hat Hardened Images

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the …

9.0Kritisch

CVE-2026-12701 vor 3 Monaten

Pulpcore: pulpcore: relative_path_validator bypass via directory traversal in filesystemexport

Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Red Hat Satellite 6.16 for RHEL 8

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrat…

1.2%EPSS

5.3Mittel

CVE-2026-15588 vor 3 Monaten

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote att…

7.1Hoch

CVE-2026-16118 vor 3 Monaten

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

xdg xdgmime; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the…

7.5Hoch

CVE-2026-58016 vor 4 Monaten