RHSA-2025:13267HighCVSS 9.1

Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

Published
August 6, 2025
Last Modified
August 27, 2026

🔗 CVE IDs covered (10)

CVE-2024-12718 →CVE-2025-4138 →CVE-2025-4330 →CVE-2025-6965 →CVE-2025-7425 →CVE-2025-49796 →CVE-2025-4435 →CVE-2025-4517 →CVE-2025-6021 →CVE-2025-40909 →

📋 Description

CVE-2024-12718 — cpython: python: Bypass extraction filter to modify file metadata outside extraction directory CVE-2025-4138 — cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory CVE-2025-4330 — cpython: python: Extraction filter bypass for linking outside extraction directory CVE-2025-4435 — cpython: Tarfile extracts filtered members when errorlevel=0 CVE-2025-4517 — python: cpython: Arbitrary writes via tarfile realpath overflow CVE-2025-6021 — libxml2: Integer Overflow in xmlBuildQName() Leads to Stack Buffer Overflow in libxml2 CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-7425 — libxslt: libxml2: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr CVE-2025-40909 — perl: Perl threads have a working directory race condition where file operations may target unintended paths CVE-2025-49796 — libxml: Type confusion leads to Denial of service (DoS)

🎯 Affected products5

  • Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad07f55ee75fb20310c88f154a04665bd8465d138d66c665c300f61447858344_amd64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-server-rhel9@sha256:c517869dacaf4d3650310d4a52e83706e0b311d6ebb4a9b37b1c7acff5c142ec_arm64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-ui-rhel9@sha256:18fa5a5b82d77afe7a92e0115daf8c23df0f817d5917747d35212dc7e4c66413_amd64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-ui-rhel9@sha256:2020475c1f39087c770ff031c3a4c0b384aa680b1b9a8278ad80d127420ffffc_arm64 as a component of Red Hat Discovery 2

✅ Remediation

The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Red Hat recommends upgrading to a fixed release of Python as soon as one is available. This vulnerability can be mitigated by rejecting links inside tarfiles that use relative references to the parent directory. The upstream advisory provides this example code: ''' # Avoid insecure segments in link names. for member in tar.getmembers(): if not member.islnk(): continue if os.pardir in os.path.split(member.linkname): raise OSError("Tarfile with insecure segment ('..') in linkname") # Now safe to extract members with the data filter. tar.extractall(filter="data") ''' Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are strongly advised to apply vendor-supplied patches as soon as they become available to address the underlying integer overflow flaw in the affected code. Workaround: There's no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library.

🔗 References (14)