Red Hat Linux Security Advisories & Vulnerabilities
16067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2024-6840] Automation-controller: gain access to the k8s api server via job execution with container group
An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account. Red Hat severity: Moderate — CVSS 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N). Weakness: CWE-285. Affected Red Hat products: Red Hat Ansible Automation Platform 2.4 for RHEL 8; Red Hat Ansible Automation Platform 2.4 for RHEL 9. Red Hat fixing advisory: RHSA-2024:6428.
High [CVE-2023-6841] Keycloak: amount of attributes per object is not limited and it may lead to dos
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. Red Hat has evaluated this vulnerability and it only affects the Red Hat Single Sign-On (RHSSO). Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-231. Affected Red Hat products: Red Hat Single Sign-On 7. Red Hat lists Red Hat build of Quarkus; Red Hat Fuse 7; Red Hat Mobile Application Platform 4; Red Hat OpenShift Application Runtimes; Red Hat Process Automation 7; Red Hat support for Spring Boot as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Low [CVE-2024-8443] Libopensc: heap buffer overflow in openpgp driver when generating key
A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs during the card enrollment process using the `pkcs15-init` tool may lead to out-of-bound rights, possibly resulting in arbitrary code execution. As this flaw requires physical access and has a high complexity level to be exploited, it has been considered a Low severity vulnerability. Red Hat severity: Low — CVSS 2.9 (CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Weakness: CWE-122. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: opensc.
High [CVE-2024-7341] session fixation in elytron saml adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation. This vulnerability is categorized as moderate severity rather than critical due to its specific exploitation conditions and impact. This pre-condition limits the exploitation vector to scenarios where an attacker has already gained some level of access or control. Additionally, the attack only impacts sessions where the `turnOffChangeSessionIdOnLogin` option is not set to true. Consequently, while it does pose a risk by potentially allowing unauthorized access if the session ID is not updated, the overall likelihood and impact of successful exploitation are mitigated by these constraints. Red Hat severity: Moderate — CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-384. Affected Red Hat products: Red Hat Build of Keycloak; Red Hat build of Keycloak 22; Red Hat build of Keycloak 24; Red Hat Single Sign-On 7; Red Hat Single Sign-On 7.6 for RHEL 7; Red Hat Single Sign-On 7.6 for RHEL 8; Red Hat Single Sign-On 7.6 for RHEL 9; RHEL-8 based Middleware Containers.
Medium [CVE-2024-2199 +1] 389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for CVE-2024-2199)
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input. Red Hat severity: Moderate — CVSS 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-20. Affected Red Hat products: Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat lists Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected. Red Hat fixing advisory: RHSA-2024:7434. Affected products named by the advisory: Red Hat package: 389-ds-base.
High [CVE-2024-8418] Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service
A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and resulting in other DNS queries timing out. This issue prevents legitimate users from accessing DNS services, thereby disrupting normal operations and causing service downtime. This vulnerability is classified as moderate severity because it affects the availability of the service rather than compromising data confidentiality or integrity. The CVSS score reflects its impact on system availability, as the DoS attack can lead to significant downtime and service disruption but does not involve unauthorized data access or code execution. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-400. Affected Red Hat products: Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2025:7094. Affected products named by the advisory: Red Hat package: aardvark-dns.
Medium [CVE-2024-45619] Libopensc: incorrect handling length of buffers or files in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed. Red Hat severity: Low — CVSS 4.3 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: opensc.
Low [CVE-2024-45620] Libopensc: incorrect handling of the length of buffers or files in pkcs15init
A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed. Red Hat severity: Low — CVSS 3.9 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: opensc.
Low [CVE-2024-45618] Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init
A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. Red Hat severity: Low — CVSS 3.9 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-457. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: opensc.
Low [CVE-2024-45617] Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized. Red Hat severity: Low — CVSS 3.9 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-457. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: opensc.
Low [CVE-2024-45616] Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card. Red Hat severity: Low — CVSS 3.9 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-457. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: opensc.
Low [CVE-2024-45615] Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. The problem is missing initialization of variables expected to be initialized (as arguments to other functions, etc.). Red Hat severity: Low — CVSS 3.9 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-457. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: opensc.
Medium [CVE-2024-8235] Libvirt: crash of virtinterfaced via virconnectlistinterfaces
A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon. All versions of libvirt as shipped in Red Hat Enterprise Linux prior to RHEL-9.5 are unaffected by this CVE. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10. Red Hat fixing advisory: RHSA-2024:9128. Affected products named by the advisory: Red Hat package: libvirt.
High [CVE-2024-7885] improper state management in proxy protocol parsing causes information leakage
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments. Red Hat decided to rate this vulnerability as Important because of the potential loss of Availability and no additional privileges being required. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-362. Affected products named by the advisory: HawtIO 4.0.0 for Red Hat build of Apache Camel 4; Red Hat build of Apache Camel 3.20.7 for Spring Boot; Red Hat build of Apache Camel 4.4.2 for Spring Boot; Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; and 14 more.
High [CVE-2024-6508] oauth2 insufficient state parameter entropy
An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.12; Red Hat OpenShift Container Platform 4.13; Red Hat OpenShift Container Platform 4.14; Red Hat OpenShift Container Platform 4.15; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.16; Red Hat OpenShift Container Platform 4.17; Red Hat OpenShift Container Platform 4.18.
High [CVE-2024-7557] Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai
A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access other models and APIs within the same namespace. The exposed ServiceAccount tokens, visible in the UI, can be utilized with oc --token={token} to exploit the elevated view privileges associated with the ServiceAccount, leading to unauthorized access to additional resources. This vulnerability represents a important severity issue due to its impact on both authentication and authorization mechanisms within OpenShift AI. This breach in security undermines the integrity of the platform by permitting unauthorized access to sensitive models and APIs, which can lead to data exfiltration, tampering, or misuse of resources. The exposure of ServiceAccount tokens in the UI amplifies the attack surface, making it trivial for an attacker to exploit these elevated privileges. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-305. Affected Red Hat products: Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Data Science (RHODS). Will not fix / out of support: Red Hat OpenShift Data Science (RHODS).
High [CVE-2024-7006] Libtiff: null pointer dereference in tif_dirinfo.c
A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service. The impact is localized to application stability rather than enabling remote code execution, privilege escalation, or unauthorized data access. Furthermore, exploiting this flaw requires conditions such as inducing memory allocation failures or manipulating the heap, which limits the attack surface and reduces the likelihood of successful exploitation in typical deployment environments. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2024:8833, RHSA-2024:8914, RHSA-2024:6360. Affected products named by the advisory: Red Hat package: libtiff.
High [CVE-2024-7409] Qemu: denial of service via improper synchronization in qemu nbd server during socket closure
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline. This issue is classified as Moderate severity rather than Important because it primarily results in a denial of service condition rather than a more crucial impact such as data corruption, unauthorized access, or system compromise. However, this scenario is mitigated by the fact that it requires a particular sequence of events involving client connection handling and server shutdown. Additionally, proper network segmentation and the use of secure client connections can further reduce the likelihood of this issue being exploited. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-662. Affected products named by the advisory: Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat OpenShift Container Platform 4.13; Red Hat OpenShift Container Platform 4.14; and 7 more.
High [CVE-2024-7383] Libnbd: nbd server improper certificate validation
A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic. While this can compromise the confidentiality and integrity of resources, the vulnerability is considered to be difficult to exploit under normal circumstances. Red Hat severity: Moderate — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8 Advanced Virtualization. Red Hat fixing advisory: RHSA-2024:6964, RHSA-2024:6757. Affected products named by the advisory: Red Hat package: libnbd.
High [CVE-2024-3056] Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack
A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources until it is out-of-memory (OOM) killed. While the malicious container's cgroup will be removed, the IPC resources it created are not. The malicious container is restarted, either automatically or by attacker control, repeating the process and increasing the amount of memory consumed. With a container configured to restart always, such as `podman run --restart=always`, this can result in a memory-based denial of service of the system. The vulnerability is not present in podman, but actually in the kernel. This is where any potential fix will be done and tracked. Red Hat severity: Moderate — CVSS 7.7 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:H). Weakness: CWE-400. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 3.11. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt; Red Hat package: podman.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.