Red Hat Linux Security Advisories & Vulnerabilities
16067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2024-10451] Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process
A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured during the Keycloak build process and embedded as default values in bytecode, leading to unintended information disclosure. In Keycloak 26, sensitive data specified directly in environment variables during the build process is also stored as a default values, making it accessible during runtime. Indirect usage of environment variables for SPI options and Quarkus properties is also vulnerable due to unconditional expansion by PropertyMapper logic, capturing sensitive data as default values in all Keycloak versions up to 26.0.2. Red Hat Enterprise Application Platform 8 does not ship the affected component and so is not affected by this flaw. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-798. Affected Red Hat products: Red Hat build of Keycloak 24; Red Hat build of Keycloak 24.0.9; Red Hat build of Keycloak 26.0; Red Hat build of Keycloak 26.0.6; Red Hat Single Sign-On 7. Will not fix / out of support: Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2024:10175, RHSA-2024:10176, RHSA-2024:10177, RHSA-2024:10178.
Medium [CVE-2024-10270] Org.keycloak:keycloak-services: keycloak denial of service
A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity. Red Hat Enterprise Application Platform 8 does not ship or provide the affected component, and so is not affected by this flaw. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333. Affected Red Hat products: Red Hat build of Keycloak 24; Red Hat build of Keycloak 24.0.9; Red Hat build of Keycloak 26.0; Red Hat build of Keycloak 26.0.6; Red Hat Single Sign-On 7. Red Hat lists Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Will not fix / out of support: Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2024:10175, RHSA-2024:10176, RHSA-2024:10177, RHSA-2024:10178.
Medium [CVE-2024-9666] keycloak proxy header handling denial-of-service (dos) vulnerability
A vulnerability was found in the Keycloak Server. When Keycloak is configured to accept incoming proxy headers, it may accept non-IP values, such as obfuscated identifiers, without proper validation. This issue can lead to costly DNS resolution operations, which an attacker could exploit to tie up IO threads and potentially cause a denial of service. Red Hat Enterprise Application Server 8 does not ship the affected component and so is not affected by this flaw. Red Hat severity: Low — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-444. Affected Red Hat products: Red Hat build of Keycloak 24; Red Hat build of Keycloak 24.0.9; Red Hat build of Keycloak 26.0; Red Hat build of Keycloak 26.0.6; Red Hat Build of Keycloak. Red Hat lists Red Hat JBoss Enterprise Application Platform 8 as not affected. Red Hat fixing advisory: RHSA-2024:10175, RHSA-2024:10176, RHSA-2024:10177, RHSA-2024:10178.
Medium [CVE-2024-6538] Openshift-console: openshift console: server-side request forgery
A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies all or part of a URL to the server to query. The server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering. Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system. The full response to these requests is returned by the endpoint. While the name of this endpoint suggests the requests are only bound to the internet, no such checks are in place. An authenticated user can therefore ask the console to perform arbitrary HTTP requests from outside the cluster to a service inside the cluster. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-918. Affected Red Hat products: Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.17; Red Hat OpenShift Container Platform 4.18; Red Hat OpenShift Container Platform 4.14; Red Hat OpenShift Container Platform 4.15. Red Hat fixing advisory: RHSA-2025:8556, RHSA-2025:8280, RHSA-2025:7863, RHSA-2025:19058, RHSA-2025:14397.
Low [CVE-2024-10492] keycloak path trasversal
A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider configuration and set up a Vault read file, which will only inform whether that file exists or not. Red Hat has evaluated this vulnerability. This issue only affects the keycloak-quarkus-server, which is present on the Red Hat Build of Keycloak. No other products are affected. Red Hat severity: Low — CVSS 2.7 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-73. Affected Red Hat products: Red Hat build of Keycloak 24; Red Hat build of Keycloak 24.0.9; Red Hat build of Keycloak 26.0; Red Hat build of Keycloak 26.0.6; Red Hat Single Sign-On 7. Red Hat lists Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Will not fix / out of support: Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2024:10175, RHSA-2024:10176, RHSA-2024:10177, RHSA-2024:10178.
Medium [CVE-2024-52616] Avahi: avahi wide-area dns predictable transaction ids
A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-334. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:7437. Affected products named by the advisory: Red Hat package: avahi.
Medium [CVE-2024-52615] Avahi: avahi wide-area dns uses constant source port
A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Moderate impact affects Red Hat Enterprise Linux, OpenShift Container Platform, and Red Hat In-Vehicle OS where Avahi wide-area DNS is used. Avahi sends wide-area DNS queries from a constant source port, making malicious DNS response injection and DNS spoofing easier; the Red Hat CVSS is 5.3 (Moderate). The issue is limited to wide-area DNS, and.local multicast DNS (mDNS) is not affected. For OpenShift Container Platform, remediation is deferred because the exposure is limited to this specific wide-area DNS use; residual risk remains for configurations that actively use wide-area DNS. For delegated affected streams, remediation is being pursued. Community Project Fedora streams are also affected and delegated upstream. Weakness: CWE-330. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:16441, RHSA-2025:11402. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: avahi.
High [CVE-2020-25720] Samba: check attribute access rights for ldap adds of computers
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks. This bug affects Samba AD, which is not shipped in Red Hat Enterprise Linux. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-266. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat Storage 3 as not affected.
Medium [CVE-2024-49395] Mutt: neomutt: bcc email header field is indirectly leaked by cryptographic info block
In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info. Red Hat severity: Low — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-1230. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: mutt.
Medium [CVE-2024-49394] Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing
In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender. Red Hat severity: Low — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-347. Affected Red Hat products: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: mutt.
Medium [CVE-2024-49393] Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing
In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N). Weakness: CWE-347. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: mutt.
Medium [CVE-2024-11079] Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L). Weakness: CWE-20. Affected Red Hat products: Ansible Automation Platform Execution Environments; Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Enterprise Linux AI (RHEL AI). Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux AI (RHEL AI). Red Hat fixing advisory: RHSA-2024:10770, RHSA-2024:11145.
High [CVE-2024-10963] Pam: improper hostname interpretation in pam_access leads to access control bypass
A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a risk for systems that rely on this feature to control who can access certain services or terminals. This vulnerability in pam_access is rated with an Important severity because it directly impacts the integrity of access control mechanisms in secure environments. By allowing hostname spoofing to bypass restrictions intended for specific local TTYs or services, the vulnerability enables attackers with minimal effort to exploit gaps in security policies that rely on access.conf configurations. The potential for unauthorized access is significant, as attackers with root privileges on any networked device can impersonate trusted service names to evade local access controls. This vulnerability was introduced in RHEL-9.4 and does not affect previous versions of RHEL-9. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-287. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.17; and 3 more.
Medium [CVE-2024-9902] Ansible-core: ansible-core user may read/write unauthorized content
A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L). Weakness: CWE-863. Affected Red Hat products: Ansible Automation Platform Execution Environments; Red Hat Ansible Automation Platform 2.4 for RHEL 8; Red Hat Ansible Automation Platform 2.4 for RHEL 9; Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat OpenStack Platform 17.1 for RHEL 9. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Red Hat fixing advisory: RHSA-2024:8969, RHSA-2024:10762, RHSA-2024:9894, RHSA-2025:1861.
Medium [CVE-2024-10573] Mpg123: buffer overflow when writing decoded pcm samples
An out-of-bounds write flaw was found in mpg123 when handling crafted streams. When decoding PCM, the libmpg123 may write past the end of a heap-located buffer. Consequently, heap corruption may happen, and arbitrary code execution is not discarded. The complexity required to exploit this flaw is considered high as the payload must be validated by the MPEG decoder and the PCM synth before execution. Additionally, to successfully execute the attack, the user must scan through the stream, making web live stream content (such as web radios) a very unlikely attack vector. The Red Hat Product Security team has classified this vulnerability as having a Moderate severity due to the complexity of the attack and the attack vector being generally considered as local. Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2024:11193, RHSA-2024:11242. Affected products named by the advisory: Red Hat package: mpg123.
High [CVE-2024-9632] Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability
A flaw was found in the X.org server. Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a moderate severity. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-122. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Telecommunications Update Service; Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
High [CVE-2024-10295] Gateway: apicast basic auth bypass via malformed base64 headerssending non-base64 'basic' auth with special characters causes apicast to incorrectly authenticate a request
A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorized access to the backend. This issue can occur due to a failure in the base64 decoding process, which causes APICast to skip the rest of the authentication checks and proceed with routing the request upstream. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-863. Affected Red Hat products: Red Hat 3scale API Management Platform 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2024-10041] Pam: libpam: libpam vulnerable to read hashed password
A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. The PAM package as shipped in Red Hat Enterprise Linux 8 and 9 is not vulnerable to this vulnerability if SELinux is in Enforcing mode in the system. Red Hat severity: Moderate — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-922. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 7. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2024:10379, RHSA-2024:11250, RHSA-2024:9941. Affected products named by the advisory: Red Hat package: pam.
High [CVE-2024-9050] Networkmanager-libreswan: local privilege escalation via leftupdown
A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration. This issue marked with an Important severity due to its potential to enable local privilege escalation and arbitrary code execution. Since NetworkManager uses Polkit to allow unprivileged users to manage network configurations, the failure to properly sanitize the VPN configuration, particularly the `leftupdown` key, creates a direct attack vector.
Medium [CVE-2024-50312] Graphql: information disclosure via graphql introspection in openshift
A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations. Exposure to this flaw increases the attack surface, as it can facilitate the discovery of flaws or errors specific to the application's GraphQL implementation. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-200. Affected Red Hat products: Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.17; Red Hat OpenShift Container Platform 4.18. Red Hat fixing advisory: RHSA-2025:0140, RHSA-2025:0115, RHSA-2024:6122.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.