Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service, SSRF and credential leakage [CVE-2025-27152, CVE-2025-27789, CVE-2025-32996, CVE-2025-32997]

Summary Node.js modules axios and http-proxy-middleware are used by IBM App Connect Enterprise Certified Container for HTTP communications. Node.js module Babel is used for internal code generation. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service, SSRF...

CVE-2025-3528 Mirror-registry: local privilege escalation due to incorrect permissions in mirror-registry

A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the /etc/passwd. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within...

CVE-2025-3528

CVE-2025-3528 describes a local privilege escalation in OpenShift Mirror Registry due to the quay-app container having write access to /etc/passwd. Affected component: Mirror Registry (quay-app container) within OpenShift; root cause: improper file permissions enabling an attacker with container ...

CVE-2025-3528 Mirror-registry: local privilege escalation due to incorrect permissions in mirror-registry

A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the /etc/passwd. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.28 bug fix and security update

Red Hat OpenShift Container Platform release 4.17.28 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.12 bug fix and security update

Red Hat OpenShift Container Platform release 4.18.12 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

CVE-2025-1993: Weak Password Requirements

IBM App Connect Enterprise Certified Container 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, 12.7, 12.8, 12.9, and 12.10 DesignerAuthoring instances store their flows in a database that is protected by weaker than expected...

PT-2025-20554

Name of the Vulnerable Software and Affected Versions OpenShift Mirror Registry affected versions not specified Description A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the /etc/passwd file. This flaw allo...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.50 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.50 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.76 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.76 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.76 security and extras update

Red Hat OpenShift Container Platform release 4.12.76 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of...

buildah security update

An update is available for buildah. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The buildah package provides a tool for facilitating building OCI container...

container-tools bug fix and enhancement update

An update is available for container-tools. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

RLSA-2025:0923 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

container-tools security update

An update is available for module.python-podman, cockpit-podman, module.containernetworking-plugins, module.skopeo, aardvark-dns, module.oci-seccomp-bpf-hook, module.conmon, module.cockpit-podman, oci-seccomp-bpf-hook, slirp4netns, libslirp, python-podman, criu, conmon, module.slirp4netns,...

RLSA-2024:0748 Important: container-tools:4.0 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: runc: file descriptor leak "Leaky Vessels" CVE-2024-21626 A Rocky Enterprise Software Foundation Security Bulletin which addresses further details about the Leaky...

RLSA-2024:6969 Moderate: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang: net/http: memory exhaustion in Request.ParseMultipartForm CVE-2023-45290 golang: crypto/x509: Verify panics on certificates with an unknown public key algorith...

RLSA-2024:2988 Moderate: container-tools:rhel8 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect CVE-2018-25091 golang: math/big.Rat: may cause a panic or an...

RLSA-2024:4246 Moderate: container-tools security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-24786 For mo...

container-tools:rhel8 security update

An update is available for module.python-podman, cockpit-podman, module.containernetworking-plugins, module.skopeo, aardvark-dns, module.oci-seccomp-bpf-hook, module.conmon, module.cockpit-podman, oci-seccomp-bpf-hook, slirp4netns, libslirp, python-podman, criu, conmon, module.slirp4netns,...