Red Hat Linux Security Advisories & Vulnerabilities
16067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2025-0604] authentication bypass due to missing ldap bind after password reset in keycloak
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions. Moderate impact affects Red Hat Build of Keycloak (RHBK) and Red Hat Single Sign-On (RH-SSO) in the keycloak-ldap-federation component. An expired or disabled AD account can therefore regain access to Keycloak, resulting in authentication bypass with low confidentiality and integrity impact and no availability impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). For RHBK, the issue is delegated and a fix is being pursued. RH-SSO is affected but is marked WONTFIX, so the current record indicates that no fix is planned for that product. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-287. Will not fix / out of support: Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2025:2545, RHSA-2025:2544. Affected products named by the advisory: Red Hat build of Keycloak 26.0.
Critical [CVE-2024-12084] Rsync: heap buffer overflow in rsync due to improper checksum length handling
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer. This vulnerability only affects a limited range of Rsync versions, rsync-3.2.7 and rsync-3.3.0. Red Hat Enterprise Linux does not ship these versions of Rsync and is not affected. Red Hat considers the severity of this vulnerability to be Critical only in cases where anonymous read access is allowed. Depending on the configuration and implementation choices, the severity may be significantly reduced for your organization. There are two different methods for utilizing Rsync from a remote system: contacting an Rsync daemon directly with TCP or using a remote-shell program as the transport (such as ssh or rsh). The risk of this vulnerability changes depending on which connection method is used. The default configuration of an Rsync daemon (rsyncd) running as a service does not require authentication. While rsyncd can be configured to require users to provide valid credentials, anonymous read access is a common configuration used by file sharing and mirroring hosts. The capabilities of the rsyncd process may vary depending on the user configured to run the Rsync daemon.
Medium [CVE-2024-11029] Freeipa: administrative user data leaked through systemd journal
A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the worst-case scenario, where the journal log is centralized, users with access to it can have improper access to the FreeIPA administrator credentials. This vulnerability doesn't affect FreeIPA (IPA) versions as shipped with Red Hat Enterprise Linux versions before Red Hat Enterprise Linux 9.5 as it doesn't have the API audit implemented. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-497. Affected Red Hat products: Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2025:0334. Affected products named by the advisory: Red Hat package: ipa.
High [CVE-2024-12085] info leak via uninitialized stack contents
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time. This vulnerability is rated as having Important impact as it helps bypass Address Space Layout Randomization (ASLR). ASLR is a memory protection system which makes the exploitation of memory corruption vulnerabilities more difficult. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-908. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; and 21 more. Affected products named by the advisory: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Telecommunications Update Service; Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; and 17 more.
Medium [CVE-2024-12087] Rsync: path traversal vulnerability in rsync
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client. Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server. Weakness: CWE-22. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; and 13 more.
Medium [CVE-2025-23366] Org.jboss.hal:hal-console: wildfly hal console cross-site scripting
A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output used as a web page that is served to other users. The attacker must be authenticated as a user that belongs to management groups “SuperUser”, “Admin”, or “Maintainer”. This issue requires previous privilege to jeopardize an environment. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-79. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Data Grid 7; Red Hat JBoss Enterprise Application Platform 8. Red Hat lists Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Will not fix / out of support: Red Hat JBoss Data Grid 7. Red Hat fixing advisory: RHSA-2025:10931.
Medium [CVE-2024-12747] Rsync: race condition in rsync handling symbolic links
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation. Red Hat severity: Moderate — CVSS 5.6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-362. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Discovery 1.14; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHBA-2025:6470, RHSA-2025:2600, RHSA-2025:7050, RHSA-2025:8385. Affected products named by the advisory: Red Hat package: rsync.
Medium [CVE-2024-12088] Rsync: --safe-links option bypass leads to path traversal
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory. The vulnerability requires user interaction to be triggered, as the rsync client must first establish a connection/have access to the malicious rsync server (at least anonymous read-access). Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Discovery 1.14; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHBA-2025:6470, RHSA-2025:2600, RHSA-2025:7050, RHSA-2025:8385. Affected products named by the advisory: Red Hat package: rsync.
Medium [CVE-2024-12086] Rsync: rsync server leaks arbitrary client files
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. This vulnerability marked as moderate rather than important because it requires the attacker to control the rsync server, which limits the scope of exploitation to scenarios where the client interacts with untrusted or compromised servers. Additionally, the attack is non-trivial, as it relies on the attacker sending specially crafted checksum values and deducing file contents byte-by-byte based on the client’s responses. This makes the exploit more complex and time-consuming compared to direct file access vulnerabilities. Furthermore, the impact is limited to file data enumeration, and it does not allow arbitrary code execution or privilege escalation on the client. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N). Weakness: CWE-390.
Medium [CVE-2024-11736] Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables
A vulnerability was found in Keycloak. Admin users may have to access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing. Red Hat has evaluated this vulnerability and it only affects Keycloak. This should not affect any connector or adapter. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-526. Affected Red Hat products: Red Hat build of Keycloak 26.0; RHBK 26.0.8; Red Hat Build of Keycloak. Red Hat lists Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Will not fix / out of support: Red Hat Build of Keycloak. Red Hat fixing advisory: RHSA-2025:0299, RHSA-2025:0300.
Medium [CVE-2024-11734] Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers
A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that has already been terminated, leading to the failure of said request. Red Hat has evaluated this vulnerability and its impact is restricted to Keycloak. No Keycloak connectors/adapters are affected. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-693. Affected Red Hat products: Red Hat build of Keycloak 26.0; RHBK 26.0.8; Red Hat Build of Keycloak. Red Hat lists Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Will not fix / out of support: Red Hat Build of Keycloak. Red Hat fixing advisory: RHSA-2025:0299, RHSA-2025:0300.
Medium [CVE-2024-56827] Openjpeg: heap buffer overflow in lib/openjp2/j2k.c
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior. Red Hat severity: Moderate — CVSS 5.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H). Weakness: CWE-122. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:7309. Affected products named by the advisory: Red Hat package: openjpeg2.
Medium [CVE-2024-56826] Openjpeg: heap buffer overflow in bin/common/color.c
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior. Red Hat severity: Moderate — CVSS 5.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H). Weakness: CWE-122. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:7309. Affected products named by the advisory: Red Hat package: openjpeg2.
Medium [CVE-2024-8447] Narayana: deadlock via multiple join requests sent to lra coordinator
A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of service. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-833. Affected Red Hat products: Red Hat JBoss EAP XP 5.0 Update 2.0; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9; Red Hat JBoss Data Grid 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack. Will not fix / out of support: Red Hat JBoss Enterprise Application Platform 7. Red Hat fixing advisory: RHSA-2025:7620, RHSA-2025:3358, RHSA-2025:3357.
High [CVE-2024-45497] build process in openshift allows overwriting of node pull credentials
A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories. The mount is not read-only, which allows the attacker to overwrite it. By modifying the config.json file, the attacker can cause a denial of service by preventing the node from pulling new images and potentially exfiltrating sensitive secrets. This flaw impacts the availability of services dependent on image pulls and exposes sensitive information to unauthorized parties. Red Hat severity: Moderate — CVSS 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H). Weakness: CWE-732. Affected Red Hat products: Red Hat OpenShift Container Platform 4.12; Red Hat OpenShift Container Platform 4.13; Red Hat OpenShift Container Platform 4.14; Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.17; Red Hat OpenShift Container Platform 4.18; Red Hat OpenShift Container Platform 4.19; Red Hat OpenShift Container Platform 4.20; Red Hat Fuse 7. Will not fix / out of support: Red Hat Fuse 7. Red Hat fixing advisory: RHSA-2025:10270, RHSA-2025:10747, RHSA-2025:9759, RHSA-2025:9765, RHSA-2025:10294, RHSA-2025:9269, RHSA-2025:9278, RHSA-2025:9562.
High [CVE-2024-12397] quarkus http cookie smuggling
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity. Red Hat has evaluated this vulnerability. This is a very similar vulnerability to an Undertow, seen in CVE-2023-4639. Red Hat severity: Moderate — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-444. Affected Red Hat products: Cryostat 4 on RHEL 9; HawtIO HawtIO 4.2.0; Red Hat Build of Keycloak; Red Hat build of Keycloak 26.2; Red Hat build of Quarkus 3.15.3; Cryostat 3; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apicurio Registry 2; Red Hat build of OptaPlanner 8; Red Hat Fuse 7; Red Hat Integration Camel K 1; Red Hat Process Automation 7; streams for Apache Kafka. Red Hat lists Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Will not fix / out of support: Red Hat build of OptaPlanner 8; Red Hat Fuse 7. Red Hat fixing advisory: RHSA-2025:3018, RHSA-2025:8761, RHBA-2025:7525, RHBA-2025:7639, RHSA-2025:0900.
Medium [CVE-2024-12369] oidc authorization code injection
A vulnerability was found in OIDC-Client. This is usually done with a Man-in-the-Middle (MitM) or phishing attack. Red Hat has evaluated this vulnerability. Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Weakness: CWE-345. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8; Red Hat JBoss Enterprise Application Platform 7. Red Hat lists Red Hat Build of Keycloak as not affected. Will not fix / out of support: Red Hat JBoss Enterprise Application Platform 7. Red Hat fixing advisory: RHSA-2025:3992, RHSA-2025:3989.
High [CVE-2024-8676] Cri-o: checkpoint restore can be triggered from different namespaces
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the pod spec, verifying that the pod has access to the mounts it specifies are not applicable to a restored container. This flaw allows a malicious user to trick CRI-O into restoring a pod that doesn't have access to host mounts. The user needs access to the kubelet or cri-o socket to call the restore endpoint and trigger the restore. Red Hat severity: Moderate — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-285. Affected Red Hat products: Red Hat OpenShift Container Platform 4.15; Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.17; Red Hat OpenShift Container Platform 4.18; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 3.11. Red Hat fixing advisory: RHSA-2025:0648, RHBA-2024:10826, RHSA-2025:9765, RHSA-2025:3297, RHSA-2025:1908, RHSA-2025:4211. Affected products named by the advisory: Red Hat package: conmon.
High [CVE-2024-52336] Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre` or `script_post` options that permit arbitrary scripts with their absolute paths to be passed. These user or attacker-controlled executable scripts or programs could then be executed by Tuned with root privileges that could allow attackers to local privilege escalation. The `instance_create()` D-Bus method has been added via upstream commit cddcd233 and was first part of version tag v2.23.0. Hence, versions of Tuned before 2.23.0 are unaffected. Also, note that the initial versions already contained support for the script option parameters and the `instance_name` parameter. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-269. Affected Red Hat products: Fast Datapath for Red Hat Enterprise Linux 8; Fast Datapath for Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10. Red Hat fixing advisory: RHSA-2025:0880, RHSA-2025:0879, RHSA-2024:10384. Affected products named by the advisory: Red Hat package: tuned.
Medium [CVE-2024-52337] Tuned: improper sanitization of `instance_name` parameter of the `instance_create ` method
A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick the administrator. The quotes '' are usually used in TuneD logs citing raw user input, so there will always be the ' character ending the spoofed input, and the administrator can easily overlook this. This logged string is later used in logging and in the output of utilities, for example, `tuned-adm get_instances` or other third-party programs that use Tuned's D-Bus interface for such operations. This vulnerability is classified as moderate severity instead of important because it primarily affects the integrity of logging rather than directly compromising system confidentiality, availability, or functionality. While an attacker can manipulate log entries to mislead administrators or obfuscate their actions, the impact is limited to the interpretation of logs and does not inherently grant the attacker elevated privileges or direct control over the system. Additionally, the spoofing relies on administrators overlooking inconsistencies, making the success of exploitation context-dependent and less universally impactful.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.