RHSA-2026:0685MediumCVSS 5.6

Red Hat Security Advisory: Red Hat Update Infrastructure 5 security update

Published
January 15, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (8)

CVE-2025-11083 →CVE-2025-45582 →CVE-2025-61984 →CVE-2025-61985 →CVE-2024-5642 →CVE-2025-6069 →CVE-2025-6075 →CVE-2025-8291 →

📋 Description

CVE-2024-5642 — python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used CVE-2025-6069 — cpython: Python HTMLParser quadratic complexity CVE-2025-6075 — python: Quadratic complexity in os.path.expandvars() with user-controlled template CVE-2025-8291 — cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked CVE-2025-11083 — binutils: GNU Binutils Linker heap-based overflow CVE-2025-45582 — tar: Tar path traversal CVE-2025-61984 — openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand CVE-2025-61985 — openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand

🎯 Affected products5

  • Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/cds-rhel9@sha256:87d268fd03fa0063620a043b43bce078144e06849ca6b83fd0e375c13ecb15be_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/haproxy-rhel9@sha256:c0cb48d44556c064626eab0d70e5f427ac132bbd921342dcb862267413bf8d16_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/installer-rhel9@sha256:e1d64fbd0e4b90259d9fbb94736ed74c7c384d13067c6bbbb107c664683cb1a9_amd64 as a component of Red Hat Update Infrastructure 5
  • registry.redhat.io/rhui5/rhua-rhel9@sha256:4642951a6a57511f8b481a6481fcd417fc7f3de86511cdab28b9b89639c2bdb2_amd64 as a component of Red Hat Update Infrastructure 5

✅ Remediation

The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: Untrusted TAR archives should always be extracted in an empty directory. When multiple untrusted archives need to be extracted, the same directory must not be re-used without removing all content extracted form the previous archive before extracting the next archive.

🔗 References (13)