Red Hat Linux Security Advisories & CVEs
15894 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-45784] Heap Corruption from Incorrect Buffer Sizing
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80. When processing data with AES key-wrap-with-padding ciphers, the library incorrectly calculates the size of output buffers. This error can lead to memory corruption, where OpenSSL writes beyond the intended buffer boundaries. An attacker capable of influencing the input data's length could exploit this to cause a denial of service or potentially corrupt data. This Moderate flaw in `rust-openssl` can lead to heap corruption when processing data with AES key-wrap-with-padding ciphers. An attacker able to influence the plaintext length could trigger an out-of-bounds write, potentially causing a denial of service or data integrity issues. Exploitation requires the use of these specific ciphers, limiting the attack surface. Red Hat severity: Moderate — CVSS 5.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-787.
Medium [CVE-2026-45309] Authentication bypass due to path traversal in username during pre-authentication
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or.. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0. This allows the attacker to read sensitive authorized-keys files from unintended directories, potentially leading to unauthorized authentication and system access. Red Hat rates this vulnerability as Moderate rather than the upstream HIGH severity because exploitation requires the AsyncSSH server to be specifically configured with AuthorizedKeysFile %u, a non-default setting that is not commonly deployed in Red Hat environments. Affected products named by the advisory: Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9.
Medium [CVE-2026-48487] Data integrity vulnerability via malformed DNS records
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, _read_character_string and _read_string in src/zeroconf/_protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self._data_len, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records. This issue is fixed in version 0.149.16. An unauthenticated attacker on the local network can exploit a vulnerability in how the system processes incoming DNS records. By sending a specially crafted record with an excessive length, the attacker can cause the system's DNS cache and service information to be populated with manipulated or truncated data. This could lead to incorrect service discovery or other data integrity issues within the affected system. Prior to 0.149.16, the record string/character-string readers advance the parser offset using an attacker-declared RDLENGTH without checking it against the actual buffer length, allowing a malformed TXT, HINFO, or A/AAAA record to corrupt subsequent record parsing, resulting in data integrity impact for unauthenticated hosts on the local network segment (UDP/5353, 224.0.0.251 / ff02::fb).
Medium [CVE-2026-48045] Unauthenticated network attacker can cause Denial of Service
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handle_query_or_defer retained every truncated TC-bit incoming query, each up to _MAX_MSG_ABSOLUTE = 8966 bytes, in self._deferred[addr] and armed a per-address timer in self._timers[addr] without capping the per-address list or distinct addr keys, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to spoof sources, grow _deferred and _timers, and cause memory exhaustion and quadratic CPU burn. This issue is fixed in version 0.149.12. A flaw was found in zeroconf, a Python library for network service discovery. This vulnerability allows an unauthenticated attacker on the local network to send specially crafted queries. These queries can cause the system to retain large amounts of data and trigger excessive processing, leading to a denial of service (DoS) due to memory exhaustion and high CPU usage. Exploitation requires the attacker to be on the same local link as the affected host, consistent with Red Hat's Adjacent (AV:A) attack vector scoring. Red Hat's CVSS score matches the vendor/CVE.org assessment for this flaw. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Medium [CVE-2026-47184] Denial of Service via uncontrolled memory growth
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache, _expirations, _expire_heap, and service_cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, slower async_expire passes, and broken discovery, registration, and ServiceBrowser callbacks. This issue is fixed in version 0.149.7. An unauthenticated attacker on the local network can send specially crafted multicast DNS responses. This can lead to uncontrolled memory growth, causing memory exhaustion and significantly degrading the performance of the service, ultimately resulting in a denial of service (DoS). Exploitation requires the attacker to be on the same local link as the affected host, consistent with Red Hat's Adjacent (AV:A) attack vector scoring. Red Hat's CVSS score matches the vendor/CVE.org assessment for this flaw. This flaw is one of a batch of related Zeroconf issues discovered and fixed close together (CVE-2026-47180, CVE-2026-47183, CVE-2026-47184, CVE-2026-48045, CVE-2026-48487); all affect the same Red Hat product streams in the same way and were triaged consistently as a batch.
Medium [CVE-2026-47183] Denial of Service via unbounded memory growth from mDNS messages
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb) to drive memory growth until mDNS-dependent features degrade or the process is OOM-killed. This issue is fixed in version 0.149.6. An unauthenticated attacker on the local network can send specially crafted mDNS messages, causing the system to store an unbounded number of error messages. This can lead to excessive memory consumption, resulting in a denial of service (DoS) where mDNS-dependent features degrade or the process terminates unexpectedly. Prior to 0.149.6, the exception-deduplication cache that tracks malformed-packet decode errors grows without bound, retaining full tracebacks (including raw packet buffers) keyed by attacker-influenced error messages, leading to unbounded memory growth, resulting in denial of service impact for unauthenticated hosts on the local network segment (UDP/5353, 224.0.0.251 / ff02::fb).
Medium [CVE-2026-47180] Denial of Service via crafted mDNS packets
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming._decode_labels_at_offset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.__init__, causing sustained CPU burn, log flooding, and degraded mDNS-dependent features for unauthenticated hosts on the local link over UDP/5353 (224.0.0.251 / ff02::fb). This issue is fixed in version 0.149.5. This can trigger a recursion error, leading to sustained CPU usage, excessive logging, and degraded mDNS services, ultimately causing a Denial of Service. Exploitation requires the attacker to be on the same local link as the affected host, consistent with Red Hat's Adjacent (AV:A) attack vector scoring. Red Hat's CVSS score matches the vendor/CVE.org assessment for this flaw. This flaw is one of a batch of related Zeroconf issues discovered and fixed close together (CVE-2026-47180, CVE-2026-47183, CVE-2026-47184, CVE-2026-48045, CVE-2026-48487); all affect the same Red Hat product streams in the same way and were triaged consistently as a batch. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-835.
Medium [CVE-2026-53712] Authentication downgrade via TLS man-in-the-middle attack
SCRAM (Salted Challenge Response Authentication Mechanism) is part of the family of Simple Authentication and Security Layer (SASL, RFC 4422) authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.scram:scram-common allows an attacker capable of a TLS man-in-the-middle attack to silently downgrade a connection from SCRAM-SHA-256-PLUS with channel binding to standard SCRAM-SHA-256 without channel binding when TlsServerEndpoint processes an X.509 certificate using a modern signature algorithm such as Ed25519; getChannelBindingData() can return an empty byte array after NoSuchAlgorithmException, and the ScramClient builder treats that as absent channel-binding data. This issue is fixed in version 3.3. This vulnerability allows the attacker to bypass the stronger SCRAM-SHA-256-PLUS authentication with channel binding, forcing a weaker SCRAM-SHA-256 authentication without channel binding, which could compromise the integrity of the authentication. While requiring a sophisticated network attack, successful exploitation bypasses stronger channel-bound authentication, potentially compromising the integrity of user sessions. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-303.
Medium [CVE-2026-16104] Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys, when they are requested by administrators with view-only permissions. This can lead to the exposure of third-party service credentials to unauthorized personnel or through administrative logs. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to have authenticated administrative access with at least view-realm permissions. Successful exploitation allows an attacker to retrieve raw reCAPTCHA secrets and view them in administrative event logs. The vulnerability's root cause is the improper handling of sensitive configuration fields during the conversion of internal models to their API representations. Weakness: CWE-212. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-16103 +1] Incomplete fix for CIBA brute-force lockout bypass at token redemption
A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were added to the Client-Initiated Backchannel Authentication (CIBA) initiation handler but were omitted from the token redemption handler. This allows an attacker with valid client credentials to obtain access and refresh tokens for a user account that has been locked due to brute-force protection, provided the authentication request was started before the lockout occurred and was approved by the user. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that successful exploitation allows an attacker to obtain a valid user session for an account that should be temporarily disabled by brute-force protection. Successful exploitation requires a CIBA request to be in flight prior to the account lockout and necessitates user interaction for approval. The vulnerability's root cause is the omission of brute-force protector checks in the CIBA grant redemption code path. Weakness: CWE-305. Affected Red Hat products: Red Hat Build of Keycloak. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-16106] Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can remove privileged roles they are not authorized to manage, leading to a loss of access for other users and administrators. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess high-level delegated administrative privileges. Successful exploitation allows an attacker to remove privileged child roles from composites, leading to the unauthorized removal of administrative or functional roles from other users. The vulnerability's root cause is a missing per-child authorization check in the role-composite deletion REST API endpoints. Weakness: CWE-1220. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-16108] Realm default-group reads disclose hidden groups under FGAP v2
A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and identifiers of hidden default groups, even if they lack the specific permissions to view those groups. This can lead to the exposure of sensitive organizational structures or internal group names. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess delegated administrative privileges and for FGAP v2 to be enabled. Successful exploitation allows an attacker to disclose the names and identifiers of groups they are not authorized to view. Weakness: CWE-1220. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-16093] Required signed-JWT assertion policy can be bypassed with unsigned assertion headers
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned assertion header that tricks the system into thinking the policy requirements have been met. This allows the attacker to authenticate using simpler methods like a client secret even when the administrator has mandated more secure, signed assertions. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that the attacker must already possess valid client credentials to perform the bypass. Successful exploitation allows an attacker to bypass mandatory signed-JWT assertion policies by providing unsigned headers. The vulnerability's root cause is insufficient validation of the client assertion parameters and authentication method within the client policy executor. Weakness: CWE-807. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-16089] Authorization codes can be retargeted to another client session
A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their own client, potentially allowing them to obtain access tokens for a victim's identity. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to intercept a valid authorization code and have a registered client in the same realm. The vulnerability's root cause is the lack of binding between the authorization code and the issuing client identifier in the code payload. Weakness: CWE-472. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-16072] Organization invitation link exposure allows unauthorized member creation
A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface. By using this link, the administrator can create new user accounts and add them to the organization without having the required user management permissions or access to the invited email account. This allows an administrator to bypass security boundaries and add unauthorized members to an organization. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to already possess high-level administrative privileges (manage-organizations). Successful exploitation allows an attacker to bypass the manage-users permission boundary to create new managed user accounts and add them to an organization without mailbox verification. The vulnerability's root cause is the unintended exposure of the registration bearer link in the REST API response for pending invitations. Weakness: CWE-497. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7.
Medium [CVE-2026-15943] OIDC IdP update reuses masked client secret after token URL change
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires high administrative privileges to exploit. Successful exploitation allows an attacker to rebind and capture an OIDC client secret by modifying identity provider configuration fields. The vulnerability's root cause is the unconditional reuse of masked secrets during configuration updates without verifying if sensitive endpoint fields have changed. Weakness: CWE-1288. Affected Red Hat products: Red Hat Build of Keycloak. Red Hat lists Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-52584] Information disclosure via Buffer Overflow in DecodeImageAPNG function
Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function A flaw was found in libjxl. The flaw occurs within the `DecodeImageAPNG` function, which can lead to unauthorized disclosure of data. Red Hat ships libjxl as a bundled component within Firefox and Thunderbird. The vulnerable code path is in the APNG decoder (DecodeImageAPNG), which is part of the extras module used by command-line tools. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-13713] YAML::Syck: Denial of Service via crafted YAML document
YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service. This vulnerability allows a remote attacker to cause a denial of service (DoS) by providing a specially crafted YAML document. This Important vulnerability in `perl-YAML-Syck` can lead to a denial of service when processing untrusted YAML documents. The flaw, a use-after-free and double-free, causes the interpreter to crash if a specially crafted YAML document redefines an anchor during parsing. This poses a risk to Red Hat systems that handle external YAML input without sufficient validation. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
High [CVE-2026-5674] Sandbox escape and arbitrary code execution via malicious library loading
A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system. Important: This flaw in PipeWire allows for a sandbox escape, enabling arbitrary code execution outside of sandboxed environments, such as Flatpak applications, when minimal permissions are granted. Red Hat products utilizing PipeWire's PulseAudio compatibility layer are susceptible, as an attacker can load a malicious library from within a sandboxed process, bypassing isolation mechanisms. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-427. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
High [CVE-2026-15925] Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. Users must manually upgrade. A network-positioned attacker could exploit improper Transport Layer Security (TLS) hostname verification by intercepting network traffic and presenting a fraudulent certificate. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.4.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.