RHSA-2026:0414HighCVSS 8.8

Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

Published
January 8, 2026
Last Modified
August 24, 2026

🔗 CVE IDs covered (20)

CVE-2025-61985 →CVE-2025-64460 →CVE-2025-4598 →CVE-2025-6075 →CVE-2025-45582 →CVE-2025-59682 →CVE-2025-64756 →CVE-2025-66031 →CVE-2025-66418 →CVE-2024-5642 →CVE-2025-59375 →CVE-2025-61984 →CVE-2025-64720 →CVE-2025-65018 →CVE-2025-66293 →CVE-2025-6069 →CVE-2025-8291 →CVE-2025-9714 →CVE-2025-15284 →CVE-2025-12816 →

📋 Description

CVE-2024-5642 — python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used CVE-2025-4598 — systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump CVE-2025-6069 — cpython: Python HTMLParser quadratic complexity CVE-2025-6075 — python: Quadratic complexity in os.path.expandvars() with user-controlled template CVE-2025-8291 — cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked CVE-2025-9714 — libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c CVE-2025-12816 — node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications CVE-2025-15284 — qs: qs: Denial of Service via improper input validation in array parsing CVE-2025-45582 — tar: Tar path traversal CVE-2025-59375 — firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59682 — django: Potential partial directory-traversal via archive.extract() CVE-2025-61984 — openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand CVE-2025-61985 — openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand CVE-2025-64460 — Django: Django: Algorithmic complexity in XML Deserializer leads to denial of service CVE-2025-64720 — libpng: LIBPNG buffer overflow CVE-2025-64756 — glob: glob: Command Injection Vulnerability via Malicious Filenames CVE-2025-65018 — libpng: LIBPNG heap buffer overflow CVE-2025-66031 — node-forge: node-forge ASN.1 Unbounded Recursion CVE-2025-66293 — libpng: LIBPNG out-of-bounds read in png_image_read_composite CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion

🎯 Affected products5

  • Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-server-rhel9@sha256:75723049a444b5136e2d40920e2852f0840fecf60832a8bbb06e488fc9bba543_arm64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-server-rhel9@sha256:d4e8987a100ea60942306f1564679e51fa1364f6124fbfb3100959f83a1f16bf_amd64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-ui-rhel9@sha256:899bd7f941512d54af8ab369ca03028a7d27d05887ccce24bc12c7ccd3e4dbee_amd64 as a component of Red Hat Discovery 2
  • registry.redhat.io/discovery/discovery-ui-rhel9@sha256:8af6fd7c8fe38d6bfd22e42810badde0aeeae738ea28667ae29dbc0cf4266f3e_arm64 as a component of Red Hat Discovery 2

✅ Remediation

The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details. Workaround: This issue can be mitigated by disabling the capability of the system to generate a coredump for SUID binaries. The perform that, the following command can be ran as `root` user: ~~~ echo 0 > /proc/sys/fs/suid_dumpable ~~~ While this mitigates this vulnerability while it's not possible to update the systemd package, it disables the capability of analyzing crashes for such binaries. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: The impact of this flaw may be reduced by setting strict resource limits to the stack size of processes at the operational system level. This can be achieved either through the 'ulimit' shell built-in or the 'limits.conf' file. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Untrusted TAR archives should always be extracted in an empty directory. When multiple untrusted archives need to be extracted, the same directory must not be re-used without removing all content extracted form the previous archive before extracting the next archive. Workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption. Workaround: To mitigate this issue, avoid using the `glob` command-line interface with the `-c` or `--cmd` option when processing filenames from untrusted sources. If programmatic use of `glob` is necessary, ensure that filenames are thoroughly sanitized before being passed to commands executed with shell interpretation enabled.

🔗 References (24)