Red Hat Linux Security Advisories & Vulnerabilities
16067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2024-1249] unvalidated cross-origin messages in checkloginiframe leads to ddos
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages. Affected products named by the advisory: Red Hat build of Keycloak 22; Red Hat Single Sign-On 7.6 for RHEL 7; Red Hat Single Sign-On 7.6 for RHEL 8; Red Hat Single Sign-On 7.6 for RHEL 9; and 6 more. Affected products named by the advisory: RHEL-8 based Middleware Containers; RHOSS-1.33-RHEL-8; Red Hat build of Apicurio Registry 2; Red Hat Decision Manager 7; and 2 more. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7; Red Hat Process Automation 7.
High [CVE-2024-1132] path transversal in redirection validation
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL. Red Hat Build of Quarkus is not impacted as this CVE affects the server-side Keycloak execution, but Quarkus only acts as a Keycloak client in its quarkus-keycloak-authorization extension. For this reason, Quarkus is marked as having a Low impact. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-22. Affected Red Hat products: Migration Toolkit for Runtimes 1 on RHEL 8; MTA-6.2-RHEL-9; Red Hat AMQ Broker 7; Red Hat build of Keycloak 22; Red Hat build of Keycloak 22.0.10; Red Hat Single Sign-On 7.6 for RHEL 7; Red Hat Single Sign-On 7.6 for RHEL 8; Red Hat Single Sign-On 7.6 for RHEL 9; RHEL-8 based Middleware Containers; RHSSO 7.6.8; Red Hat build of Apicurio Registry 2; Red Hat build of Quarkus; Red Hat Decision Manager 7; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 6; Red Hat Process Automation 7.
Medium [CVE-2024-1481] Freeipa: specially crafted http requests potentially lead to denial of service
A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service. This vulnerability poses a moderate severity risk due to its potential for a denial of service (DoS) attack and limited exploitation scope. While it allows for influencing the arguments passed to the kinit command, thereby potentially disrupting authentication processes and causing service interruptions, it does not grant unauthorized access to sensitive resources or compromise the integrity of the system. The restricted access rights of the 'ipaapi' user limit the impact to denial of service scenarios, mitigating the risk of unauthorized authentication or access to other accounts via keytab files or cached credentials. Furthermore, the vulnerability does not enable the extraction of sensitive information or the execution of arbitrary commands beyond the context of the kinit command. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-20. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2024:3044, RHSA-2024:2147.
Medium [CVE-2024-3567] Qemu-kvm: net: assertion failure in update_sctp_checksum
A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2025:4492. Affected products named by the advisory: Red Hat package: qemu-kvm.
High [CVE-2024-1233] Eap: wildfly-elytron has a ssrf security issue
A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability. The SSRF vulnerability in JwtValidator.resolvePublicKey is considered a moderate severity issue due to its potential to allow unauthorized internal network access and exposure of sensitive information, albeit with certain constraints. The vulnerability leverages the absence of URL whitelisting or filtering when resolving the jku header, which can be exploited to make HTTP requests to arbitrary URLs. While the immediate impact might not directly compromise sensitive data or system integrity, it opens a pathway for attackers to discover and interact with internal services, potentially leading to further exploitation. The exploitation complexity and the need for an attacker to craft a malicious JWT token mitigate the severity to a moderate level, as it requires a certain degree of knowledge and capability to execute effectively. Red Hat severity: Moderate — CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-918.
Medium [CVE-2024-0406] Mholt/archiver: path traversal vulnerability
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library. This is a path traversal vulnerability in v3 of mhol/archiver and has been marked as moderate for a variety of reasons. First and foremost the attacker in order to exploit this vulnerability would require local files system/code execution level access, this cannot be exploited on a network level, secondly, the successful exploitation of this vulnerability only result in overwriting of files, not denial of service due to resource exhaustion and no code execution, keeping all these things in mind redhat has assigned this as moderate impact. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat OpenShift Container Platform 4.18; Red Hat Advanced Cluster Security 3. Will not fix / out of support: Red Hat Advanced Cluster Security 3. Red Hat fixing advisory: RHSA-2025:2449.
High [CVE-2024-31083] Xorg-x11-server: use-after-free in procrenderaddglyphs
A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request. Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a Moderate severity. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-416. Affected products named by the advisory: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.2 Telecommunications Update Service; and 10 more.
High [CVE-2024-31081] Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a Moderate severity. Red Hat severity: Important — CVSS 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H). Weakness: CWE-126. Affected products named by the advisory: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.2 Telecommunications Update Service; and 10 more.
High [CVE-2024-31080] Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. The Xorg server is not configured to run with root privileges in Red Hat Enterprise Linux 8 and 9. Consequently, these versions have been assigned a Moderate severity rating. Red Hat severity: Important — CVSS 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H). Weakness: CWE-126. Affected products named by the advisory: Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.2 Telecommunications Update Service; and 10 more.
High [CVE-2024-2700] leak of local configuration properties into quarkus applications
A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been set by the developer or CI environment for testing purposes, such as dropping the database during application startup or trusting all TLS certificates to accept self-signed certificates. If these properties are configured using environment variables or the.env facility, they are captured into the built application, which can lead to dangerous behavior if the application does not override these values. This behavior only happens for configuration properties from the `quarkus.*` namespace. Red Hat rates this as a Moderate impact vulnerability since this requires an attacker to have direct access to the environment variables to override, and the application must use that environment variable to be jeopardized. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-526. Affected products named by the advisory: HawtIO 4.0.0 for Red Hat build of Apache Camel 4; Red Hat AMQ Streams 2.7.0; Red Hat build of Apicurio Registry 2.6.1 GA; Red Hat build of Quarkus 3.2.12.Final; and 8 more.
Medium [CVE-2024-3296] Rust-openssl: timing based side-channel can lead to a bleichenbacher style attack
A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of trial messages for decryption. The vulnerability affects the legacy PKCS#1v1.5 RSA encryption padding mode. The Red Hat Enterprise Linux remains unaffected by this vulnerability since it does not include the vulnerable codebase or version. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-208. Red Hat lists Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Medium [CVE-2024-1300] Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support
A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support. When processing an unknown SNI server name assigned the default certificate instead of a mapped certificate, the SSL context is erroneously cached in the server name map, leading to memory exhaustion. This flaw allows attackers to send TLS client hello messages with fake server names, triggering a JVM out-of-memory error. Affected products named by the advisory: Cryostat 2 on RHEL 8; Migration Toolkit for Runtimes 1 on RHEL 8; MTA-6.2-RHEL-9; Red Hat build of Quarkus 3.2.11.Final; and 8 more. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 3; Red Hat Build of Keycloak; Red Hat build of OptaPlanner 8; Red Hat Integration Camel K 1; and 3 more. Affected products named by the advisory: Red Hat Integration Camel Quarkus 2; Red Hat JBoss Data Grid 7; Red Hat Process Automation 7; Red Hat build of Apache Camel 4 for Quarkus 3.
High [CVE-2024-3019] Pcp: exposure of the redis server backend allows remote command execution via pmproxy
A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer. PCP, as shipped in Red Hat Enterprise Linux 6 and 7, is not affected by this vulnerability because the Redis server backend is not enabled and exposed via pmproxy. Additionally, RHEL9 is not exploitable if the redis:7 module is installed instead of the default Redis version 6. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-668. Affected products named by the advisory: Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Telecommunications Update Service; Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions; and 5 more.
High [CVE-2024-2947] Cockpit: command injection when deleting a sosreport with a crafted name
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer. Red Hat severity: Moderate — CVSS 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-77. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2024:3667, RHSA-2024:3843. Affected products named by the advisory: Red Hat package: cockpit.
Medium [CVE-2024-1023] memory leak due to the use of netty fastthreadlocal data structures in vertx
A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge, allowing an attacker to exploit this vulnerability. For instance, a server accepting arbitrary internet addresses could serve as an attack vector by connecting to these addresses, thereby accelerating the memory leak. Affected products named by the advisory: Cryostat 2 on RHEL 8; MTA-6.2-RHEL-9; Red Hat build of Quarkus 3.2.11.Final; Red Hat build of Apache Camel for Spring Boot 3; and 6 more. Affected products named by the advisory: Red Hat Build of Keycloak; Red Hat build of OptaPlanner 8; Red Hat Data Grid 8; Red Hat Integration Camel K 1; and 2 more. Affected products named by the advisory: Red Hat Integration Camel Quarkus 2; Red Hat JBoss Data Grid 7; Red Hat build of Apache Camel 4 for Quarkus 3.
High [CVE-2023-5685] Xnio: stackoverflowexception when the chain of notifier states becomes problematically big
A flaw was found in XNIO. The XNIO NotifierState that can cause a Stack Overflow Exception when the chain of notifier states becomes problematically large can lead to uncontrolled resource management and a possible denial of service (DoS). Red Hat rates this vulnerability as an Important impact as the uncontrolled resource consumption may lead to Denial of Service (DoS). This might be intentioned by an attacker who is looking to jeopardize an environment. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-400. Affected Red Hat products: Red Hat build of Apache Camel 4.4.0 for Spring Boot; Red Hat JBoss Enterprise Application Platform; Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7; Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9; Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7; Red Hat build of Apache Camel - HawtIO 4; Red Hat Integration Camel K 1; Red Hat JBoss Data Grid 7; Red Hat JBoss Fuse Service Works 6; Red Hat Process Automation 7.
High [CVE-2024-1394] Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them. The majority of RHEL utilities are not long-running applications; instead, they are command-line tools. These tools utilize Golang package as build-time dependency, which is why they are classified as having a "Moderate" level of impact. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-401. Affected products named by the advisory: Red Hat Ansible Automation Platform 2.4 for RHEL 8; Red Hat Ansible Automation Platform 2.4 for RHEL 9; Red Hat Developer Tools; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; and 37 more.
Medium [CVE-2024-2494] Libvirt: negative g_new0 length can lead to unbounded memory allocation
A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a crash due to the negative length being treated as a huge positive number. This flaw allows a local, unprivileged user to perform a denial of service attack by causing the libvirt daemon to crash. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-789. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8 Advanced Virtualization. Red Hat fixing advisory: RHSA-2024:3253, RHSA-2024:2560. Affected products named by the advisory: Red Hat package: libvirt.
Medium [CVE-2024-28834] Gnutls: vulnerable to minerva side-channel information leak
A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel. The Minerva attack vulnerability in GnuTLS, as identified through deterministic code behavior, poses a moderate severity risk due to its potential exploitation in cryptographic systems. This vulnerability enables adversaries to infer information about the cryptographic operations by observing subtle variations in nonce sizes, leading to a side-channel attack. The deterministic nature of the code allows attackers to discern patterns in the nonce generation process, thereby compromising the confidentiality and integrity of cryptographic communications. While the impact of this vulnerability may not be immediate or widespread, its exploitation could facilitate targeted attacks against systems relying on GnuTLS for secure communication. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-327.
Medium [CVE-2024-28835] Gnutls: potential crash during chain building/verification
A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted.pem bundle using the "certtool --verify-chain" command. The observed crash in GnuTLS during certificate chain verification, triggered by a specific certificate configuration, represents a moderate severity issue due to its potential impact on security-critical operations reliant on certificate validation. The crash may indicate an underlying flaw in GnuTLS's handling of certain certificate attributes or structures, potentially exposing systems to denial-of-service vulnerabilities or bypassing security checks if exploited maliciously. Given that certificate validation is a fundamental aspect of secure communication protocols such as TLS, the inability to reliably verify certificate chains could lead to unauthorized access, data integrity breaches, or interception of sensitive information. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-248. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat lists Red Hat Enterprise Linux 8 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.