132556 matches found
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (Neuron)
Red Hat AI Base Images 3.3.4 Neuron is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.56 security and extras update
Red Hat OpenShift Container Platform release 4.18.56 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.58 security and extras update
Red Hat OpenShift Container Platform release 4.17.58 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a security impact of...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (CUDA 12.9)
Red Hat AI Base Images 3.3.4 CUDA 12.9 is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (Spyre)
Red Hat AI Base Images 3.3.4 Spyre is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (ROCm 7.0)
Red Hat AI Base Images 3.3.4 ROCm 7.0 is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (CUDA 13.0)
Red Hat AI Base Images 3.3.4 CUDA 13.0 is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (ROCm 6.4)
Red Hat AI Base Images 3.3.4 ROCm 6.4 is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (TPU)
Red Hat AI Base Images 3.3.4 TPU is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.3.4 (CPU)
Red Hat AI Base Images 3.3.4 CPU is now available. Red Hat® AI Base Images...
podman: podman: The `podman run` command can be instructed to disable almost all sandboxing - including user-requested sandboxing - by image annotation
A flaw was found in Podman. When a container image with checkpoint annotations is executed using the podman run command, Podman treats the image as a restored checkpoint and ignores user-specified sandboxing options, such as dropped privileges. An attacker can exploit this issue by enticing a use...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: podman: podman-6.1.2-1.1.hum1 aarch64, x8664 podman-docker-6.1.2-1.1.hum1 noarch podman-machine-6.1.2-1.1.hum1 aarch64, x8664 podman-remote-6.1.2-1.1.hum1 aarch64, x8664 podmansh-6.1.2-1.1.hum1...
brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service DoS by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the...
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns
A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial ...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs26: nodejs26-26.10.0-0.3.hum1 aarch64, x8664 nodejs26-bin-26.10.0-0.3.hum1 noarch nodejs26-devel-26.10.0-0.3.hum1 aarch64, x8664 nodejs26-docs-26.10.0-0.3.hum1 noarch...
brace-expansion: brace-expansion: Denial of Service via crafted brace patterns
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service DoS by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive...
brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service DoS by supplying untrusted input containing deeply nested brace patterns. Due to uncontrolled recursion during pattern processing, expanding these nested structures exhausts the call stack and causes the...
brace-expansion: brace-expansion: Denial of Service via crafted brace patterns
A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service DoS by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive...
brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns
A flaw was found in brace-expansion. A remote attacker can provide specially crafted brace patterns with excessive nested groups or large arrays to trigger uncontrolled recursion during parsing. This behavior exhausts the native call stack and crashes the application process, leading to a Denial ...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.21.0-1.2.hum1 aarch64, x8664 nodejs24-bin-24.21.0-1.2.hum1 noarch nodejs24-devel-24.21.0-1.2.hum1 aarch64, x8664 nodejs24-docs-24.21.0-1.2.hum1 noarch...
openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations
A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm ECDSA or SM2, using curves withou...
openssl: openssl: Denial of Service via crafted CMP certificate revocation response
A flaw was found in OpenSSL. When a Certificate Management Protocol CMP client requests certificate revocation using a PKCS10 Certificate Signing Request CSR, it omits the certificate issuer name and serial number. A malicious or compromised CMP server, or an attacker possessing valid message...
openssl: OpenSSL: Private key recovery via SM2 timing side-channel
A flaw was found in OpenSSL. During SM2 signature generation, variable-time arithmetic operations are performed on secret values, creating an observable timing side-channel. An attacker capable of measuring signature generation times can collect timing data across multiple signing operations, whi...
openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission
A flaw was found in OpenSSL. The Datagram Transport Layer Security DTLS retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to...
openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog
A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by flooding a connection with connection identifier update requests while withholding acknowledgments. This behavior bypasses connection limits and forces the system to accumulate pending retirement frames, resulting...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openssl3: openssl3-devel-3.5.9-0.1.hum1 aarch64, x8664 openssl3-devel-engine-3.5.9-0.1.hum1 aarch64, x8664 openssl3-libs-3.5.9-0.1.hum1 aarch64, x8664 openssl3-3.5.9-0.1.hum1.src src...
openssl: openssl: Denial of Service via excessive QUIC packet buffer retention
A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by sending specially crafted network packets to a QUIC protocol endpoint. Because the QUIC stack retains memory in packet buffers until the receiving application reads the stream data, an attacker can manipulate data...
openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch
A flaw was found in openssl. When a server replaces its security context during an active Transport Layer Security TLS handshake, it fails to update the internal capacity tracking for cryptographic signature algorithms. A remote peer can exploit this issue by advertising specific signature...
openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting
A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service DoS attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to...
openssl: openssl: Denial of Service via inefficient QUIC stream reassembly
A flaw was found in OpenSSL. A remote attacker who establishes a QUIC network connection can cause a Denial of Service DoS by sending specially sequenced, out-of-order stream frames. Because the stream reassembly mechanism handles non-sequential data fragments inefficiently, processing these fram...
openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing
A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by presenting a specially crafted certificate during a Transport Layer Security TLS handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List CRL distribution...
openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V
A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side...
openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control
A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS due to missing connection-level flow control enforcement in the QUIC protocol implementation. By opening multiple streams that respect individual stream limits while preventing data consumption, the attacker can forc...
openssl: OpenSSL: Denial of Service via undersized DTLS record
A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service DoS by terminating an active Datagram Transport Layer Security DTLS session. By sending an undersized network packet that is shorter than the expected cryptographic overhead, the record processing layer...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.12-0.2.hum1 aarch64, x8664 grafana12.4-12.4.12-0.2.hum1.src src...
github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API
A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface API to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is...
grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation
A flaw was found in Grafana. A user with an Editor role can exploit a stored cross-site scripting XSS vulnerability in the Geomap panel. This occurs because the Geomap panel loads map styles from a URL and inserts the style's attribution field into the page without proper sanitization. By...
grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing...
grafana: grafana: Authorization bypass via missing destination folder permission check
A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder...
openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations
A flaw was found in OpenSSL. A timing side-channel vulnerability in generic elliptic curve scalar multiplication allows an attacker to recover private cryptographic keys. When performing signature operations, such as the Elliptic Curve Digital Signature Algorithm ECDSA or SM2, using curves withou...
openssl: OpenSSL: Denial of Service via undersized DTLS record
A flaw was found in OpenSSL. A remote, unauthenticated attacker can cause a Denial of Service DoS by terminating an active Datagram Transport Layer Security DTLS session. By sending an undersized network packet that is shorter than the expected cryptographic overhead, the record processing layer...
openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing
A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by presenting a specially crafted certificate during a Transport Layer Security TLS handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List CRL distribution...
openssl: openssl: Traffic amplification Denial of Service via QUIC packet over-accounting
A flaw was found in OpenSSL. This vulnerability allows a remote attacker to abuse the server to amplify network traffic in a Denial of Service DoS attack. When the server is configured without client address validation, incoming datagrams containing multiple QUIC packets cause the server to...
openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch
A flaw was found in openssl. When a server replaces its security context during an active Transport Layer Security TLS handshake, it fails to update the internal capacity tracking for cryptographic signature algorithms. A remote peer can exploit this issue by advertising specific signature...
openssl: openssl: Denial of Service via crafted CMP certificate revocation response
A flaw was found in OpenSSL. When a Certificate Management Protocol CMP client requests certificate revocation using a PKCS10 Certificate Signing Request CSR, it omits the certificate issuer name and serial number. A malicious or compromised CMP server, or an attacker possessing valid message...
openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission
A flaw was found in OpenSSL. The Datagram Transport Layer Security DTLS retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to...
openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog
A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by flooding a connection with connection identifier update requests while withholding acknowledgments. This behavior bypasses connection limits and forces the system to accumulate pending retirement frames, resulting...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openssl: openssl-3.5.9-0.1.hum1 aarch64, x8664 openssl-config-fips-3.5.9-0.1.hum1 aarch64, x8664 openssl-devel-3.5.9-0.1.hum1 aarch64, x8664 openssl-devel-engine-3.5.9-0.1.hum1 aarch64, x8664...
openssl: openssl: Denial of Service via excessive QUIC packet buffer retention
A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by sending specially crafted network packets to a QUIC protocol endpoint. Because the QUIC stack retains memory in packet buffers until the receiving application reads the stream data, an attacker can manipulate data...
openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V
A flaw was found in OpenSSL. The optimized scalar point multiplication used for SM2 cryptographic operations on ARM64 and RISC-V architectures does not execute in constant time. An attacker capable of measuring execution times or observing processor cache-access patterns can exploit this side...