Red Hat Hardened Images/openshell

Red Hat · Package

7 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationCVE-2026-116794 · GHSA-VP5Q-FF62-JWQV	russh Red Hat Hardened Images/openshell	Rust / CargoRed Hat	High	Fix reported	2026-10-31
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesCVE-2026-116696 · GHSA-9WFM-JCJ8-JFV9	russh Red Hat Hardened Images/openshell	Rust / CargoRed Hat	Low	Fix reported	2026-10-31
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsCVE-2026-116773 · GHSA-4P9F-7P9M-5VFG	russh Red Hat Hardened Images/openshell	Rust / CargoRed Hat	Medium	Fix reported	2026-10-31
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)CVE-2026-116774 · GHSA-FW5C-8223-6H42	russh Red Hat Hardened Images/openshell	Rust / CargoRed Hat	Medium	Fix reported	2026-10-31
russh: Unbounded memory allocation in agent protocol server via crafted constraint recordsCVE-2026-111061 · GHSA-4WC5-F2RC-Q74M	russh Red Hat Hardened Images/openshell	Rust / CargoRed Hat	Medium	Fix reported	2026-10-19
hex: hex: Denial of Service via unconstrained data decompressionCVE-2026-96618	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9	Red Hat	Medium	No fix reported	Not recorded
hex: hex: Terminal output spoofing via unescaped control sequencesCVE-2026-81856	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9	Red Hat	Medium	No fix reported	Not recorded