Red Hat OpenShift Container Platform 4/rpm-ostree

Red Hat · Package

15 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
Tokio: Race condition in `tokio::time::Interval`CVE-2026-115567 · GHSA-5WJR-9356-4WC8Version ranges need review.	tokio Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9	Rust / CargoRed Hat	Medium	Fix reported	2026-10-24
Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review.	tracing-subscriber Confidential Compute Attestation/build-of-trustee/trustee-rhel9	Rust / CargoRed Hat	Low	Fix reported	2026-10-12
node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)CVE-2026-53655 · GHSA-VMF3-W455-68VH	tar Confidential Compute Attestation/openshift-sandboxed-containers/osc-pccs	npmRed Hat	Medium	Fix reported	2026-09-10
tar-rs `unpack_in` can chmod arbitrary directories by following symlinksCVE-2026-33056 · GHSA-J4XF-2G29-59PHVersion ranges need review.	tar Confidential Compute Attestation/openshift-sandboxed-containers/osc-monitor-rhel9	Rust / CargoRed Hat	Medium	Fix reported	2026-09-10
time vulnerable to stack exhaustion Denial of Service attackCVE-2026-25727 · GHSA-R6V5-FH4H-64XCVersion ranges need review.	time Confidential Compute Attestation/build-of-trustee/trustee-rhel9	Rust / CargoRed Hat	Medium	Fix reported	2026-09-10
`openssl` `X509VerifyParamRef::set_host` buffer over-readCVE-2023-53159 · GHSA-XCF7-RVMH-G6Q4Version ranges need review.	openssl Logging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle	Rust / CargoRed Hat	Medium	Fix reported	2026-09-10
rust-openssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`CVE-2025-3416	Red Hat Directory Server 11/redhat-ds:11/389-ds-base Red Hat Directory Server 12/redhat-ds:12/389-ds-base	Red Hat	Low	No fix reported	Not recorded
cJSON: cJSON rejects a valid textCVE-2023-26819	Red Hat Enterprise Linux 8/rpm-ostree Red Hat Enterprise Linux 9/rpm-ostree	Red Hat	Low	No fix reported	Not recorded
uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versionsCVE-2026-41988	Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 Confidential Cluster Operator/confidential-clusters-beta/buildroot-rhel9	Red Hat	Low	No fix reported	Not recorded
tar: tar-rs: Information Disclosure via Symlink EscapeCVE-2026-70622	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 OpenShift Lightspeed/openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9	Red Hat	Medium	No fix reported	Not recorded
nix: Nix: Arbitrary file truncation via time-of-check/time-of-use raceCVE-2026-64846	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Compute Attestation/agent-sandbox/agent-sandbox-router	Red Hat	Low	No fix reported	Not recorded
openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()CVE-2026-75803	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9	Red Hat	Low	No fix reported	Not recorded
hex: hex: Denial of Service via unconstrained data decompressionCVE-2026-96618	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9	Red Hat	Medium	No fix reported	Not recorded
hex: hex: Terminal output spoofing via unescaped control sequencesCVE-2026-81856	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9	Red Hat	Medium	No fix reported	Not recorded
openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmissionCVE-2026-84782	Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 Confidential Compute Attestation/agent-sandbox/agent-sandbox-router	Red Hat	High	No fix reported	Not recorded