IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API

Vulnerabilidades de openshift builds (CVE)

Registros CVE publicados para openshift builds, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

1.7 171.8 121.6 61.3 11.9 1
21 resultados
6.8Media
CVE-2026-114406

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certif…

7.1Alta
CVE-2026-10840

Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources

Red Hat Red Hat OpenShift Builds 1.7.3; Red Hat Red Hat OpenShift Builds 1.8.1; Red Hat OpenShift Pipelines

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources via the tekton-scheduler-role ClusterRole. When Kueue or ce…

6.5Media
CVE-2026-27145

Inefficient candidate hostname parsing in crypto/x509

Go standard library crypto/x509; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

9.6Crítica
CVE-2026-39821

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Go standard library net/http; Go standard library net/http/internal/http2; golang.org/x/net golang.org/x/net/idna; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege …

1.8%EPSS
9.1Crítica
CVE-2026-42508

Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts

golang.org/x/crypto golang.org/x/crypto/ssh/knownhosts; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

6.9%EPSS
9.1Crítica
CVE-2026-39830

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited glob…

7.5Alta
CVE-2026-39829

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by …

5.3Media
CVE-2026-39835

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.

9.1Crítica
CVE-2026-39832

Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent

golang.org/x/crypto golang.org/x/crypto/ssh/agent; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote…

6.3Media
CVE-2026-39828

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

golang.org/x/crypto golang.org/x/crypto/ssh; Red Hat Cryostat 4 on RHEL 9; Red Hat RHEM 1.0 for RHEL 9; Red Hat RHEM 1.1 for RHEL 10

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil…

7.5Alta
CVE-2026-33811

Crash when handling long CNAME response in net

Go standard library net; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

7.5Alta
CVE-2026-40938

Tekton Pipelines: Git Resolver Unsanitized Revision Parameter Enables git Argument Injection Leading to RCE

tektoncd pipeline; Red Hat Red Hat OpenShift Builds 1.7.3; Red Hat Red Hat OpenShift Builds 1.8.1; Red Hat Red Hat OpenShift Pipelines 1.21

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the git resolver's revision parameter is passed directly as a positional argumen…

7.5Alta
CVE-2026-32280

Unexpected work during chain building in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

7.5Alta
CVE-2026-33810

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Enterprise Linux 10

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

9.6Crítica
CVE-2026-33211

Tekton Pipelines git resolver has path traversal that allows reading arbitrary files from the resolver pod

tektoncd pipeline; Red Hat Builds for Red Hat OpenShift 1.6.0; Red Hat Red Hat OpenShift Builds 1.7.3; Red Hat Red Hat OpenShift Pipelines 1.2

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathI…

9.1Crítica
CVE-2026-33186

gRPC-Go has an authorization bypass via missing leading slash in :path

grpc grpc-go; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

1.6%EPSS
7.5Alta
CVE-2026-25679

Incorrect parsing of IPv6 host literals in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

7.5Alta
CVE-2026-27137

Incorrect enforcement of email constraints in crypto/x509

Go standard library crypto/x509; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 9

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be…

7.5Alta
CVE-2025-61726

Memory exhaustion in query parameter parsing in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.3.1; Red Hat HawtIO HawtIO 4.4.0

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

2.3%EPSS
8.8Alta
CVE-2025-1244

Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme

emacs; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or …

2.6%EPSS