RHSA-2025:16524HighCVSS 7.8

Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

Published
September 23, 2025
Last Modified
August 23, 2026

🔗 CVE IDs covered (4)

CVE-2025-5914 →CVE-2025-6020 →CVE-2025-8194 →CVE-2025-8941 →

📋 Description

CVE-2025-5914 — libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c CVE-2025-6020 — linux-pam: Linux-pam directory Traversal CVE-2025-8194 — cpython: Cpython infinite loop when parsing a tarfile CVE-2025-8941 — linux-pam: Incomplete fix for CVE-2025-6020

🎯 Affected products5

  • Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-server-rhel9@sha256:1c67d8d526ab4f2854947f7dccd8752a2efd414c0f1cbab17706fa91147e7cda_amd64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-server-rhel9@sha256:c85cfbcaf7888885e57596b7b8bde3894718cfc33326499b24961a66a62cf083_arm64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-ui-rhel9@sha256:87fd07b40ae5dc04d446b4b44a846aeb898e56c627e917d0c0675e7905f42a02_arm64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-ui-rhel9@sha256:def60eacc396cb99e19746aa7afb3af1aa56da9fd9bba87262ad2d01a5f24a9d_amd64 as a component of Red Hat Discovery 2

✅ Remediation

The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details. Workaround: Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`. Workaround: This flaw can be mitigated by adding the following code after importing the tarfile module ("import tarfile"): ~~~ import tarfile def _block_patched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return _block_patched._orig_block(self, count) _block_patched._orig_block = tarfile.TarInfo._block tarfile.TarInfo._block = _block_patched ~~~

🔗 References (8)