openshift compliance operator güvenlik açıkları (CVE)

openshift compliance operator için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

14 sonuç

6.5Orta

CVE-2026-27145 5 ay önce

Inefficient candidate hostname parsing in crypto/x509

Go standard library crypto/x509; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

7.5Yüksek

CVE-2026-33811 6 ay önce

Crash when handling long CNAME response in net

Go standard library net; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

7.5Yüksek

CVE-2026-32280 7 ay önce

Unexpected work during chain building in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

7.5Yüksek

CVE-2026-32283 7 ay önce

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Go standard library crypto/tls; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

7.5Yüksek

CVE-2026-33810 7 ay önce

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Go standard library crypto/x509; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.4.0; Red Hat Red Hat Enterprise Linux 10

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issu…

9.1Kritik

CVE-2026-33186 7 ay önce

gRPC-Go has an authorization bypass via missing leading slash in :path

grpc grpc-go; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests …

1.6%EPSS

7.5Yüksek

CVE-2026-25679 8 ay önce

Incorrect parsing of IPv6 host literals in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

7.5Yüksek

CVE-2025-61726 9 ay önce

Memory exhaustion in query parameter parsing in net/url

Go standard library net/url; Red Hat Cryostat 4 on RHEL 9; Red Hat HawtIO HawtIO 4.3.1; Red Hat HawtIO HawtIO 4.4.0

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

2.3%EPSS

7.8Yüksek

CVE-2025-8941 1 yıl önce

Linux-pam: incomplete fix for cve-2025-6020

linux-pam; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

6.4Orta

CVE-2025-7195 1 yıl önce

Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

operator-framework operator-sdk; Red Hat RHEL-9-CNV-4.17; Red Hat RHEL-9-CNV-4.18; Red Hat RHEL-9-CNV-4.20

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 duri…

7.8Yüksek

CVE-2025-7425 1 yıl önce

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

GNOME libxml2; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attr…

7.8Yüksek

CVE-2025-6020 1 yıl önce

Linux-pam: linux-pam directory traversal

linux-pam; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

7.8Yüksek

CVE-2025-5914 1 yıl önce

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

libarchive; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerabi…

7.5Yüksek

CVE-2024-12085 1 yıl önce

Rsync: info leak via uninitialized stack contents

rsync; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitializ…

8.6%EPSS