RHSA-2026:1652HighCVSS 7.8

Red Hat Security Advisory: Red Hat Ceph Storage

Published
February 2, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (17)

CVE-2025-68973 →CVE-2025-4598 →CVE-2025-45582 →CVE-2025-59375 →CVE-2026-21441 →CVE-2025-6075 →CVE-2025-6965 →CVE-2025-8291 →CVE-2025-66471 →CVE-2025-6069 →CVE-2025-13601 →CVE-2025-61985 →CVE-2025-66418 →CVE-2024-5642 →CVE-2025-9230 →CVE-2025-9714 →CVE-2025-61984 →

📋 Description

CVE-2024-5642 — python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used CVE-2025-4598 — systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump CVE-2025-6069 — cpython: Python HTMLParser quadratic complexity CVE-2025-6075 — python: Quadratic complexity in os.path.expandvars() with user-controlled template CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-8291 — cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked CVE-2025-9230 — openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap CVE-2025-9714 — libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c CVE-2025-13601 — glib: Integer overflow in in g_escape_uri_string() CVE-2025-45582 — tar: Tar path traversal CVE-2025-59375 — firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-61984 — openssh: OpenSSH: Control characters in usernames can lead to code execution via ProxyCommand CVE-2025-61985 — openssh: OpenSSH: Null character in ssh:// URI can lead to code execution via ProxyCommand CVE-2025-66418 — urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion CVE-2025-66471 — urllib3: urllib3 Streaming API improperly handles highly compressed data CVE-2025-68973 — GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write CVE-2026-21441 — urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

🎯 Affected products25

  • Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:2b5cf457f26d63afad72ab44cdc4422fb9fddb69394924d3b91c0ea5a769c180_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:907dc2b4f568b4c03c88c46ada8cfbc93b695499be6284ed6a27b04ddd01e6b9_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:ab6890d8ec728ce45cdcaf794f3589fcd9fc994d34e409abb7daa7e7b7b7bab5_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/grafana-rhel9@sha256:b52ec296c418fa881b0e95ed15ab2042f563f805e0fddb959456ca4a8bc3c934_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:50ef4035820e9678036be404f34182b993185162861fa7812f1a50ce5a12afd1_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:9bd6c2e38c83c0298983c0194ee5e0700f925db68595e415554d39060686492e_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:a45576c219dbb118701238cbb13f9f0d59e2c1f141ebd7fb40164d9aef5bc143_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/keepalived-rhel9@sha256:fa90f5711868742cdb5d8b9288150bdf6c190756c021f5b6c4a4283d97b260c1_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:09aaeba975aa74bdf95d63e5619c0cabb1cd9e1410aa34e7f8ecf24a5e291d1a_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:97a60239048123bc963d7c9ac2ad85caa6a254759e44c15f173ca12ea51e4719_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:9e4f3ffb68eae556a6d34426903430173e4563eea3ea5d6720ce9b5b43c2dbda_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:c1c3e3e46bb57c2c99378b7336aa2c2015b7279dcb3df7fdccc8c3dee1522ba6_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:2f0246de4436b3da81abbb1b4335f9b6ea1c2b258110d17ec839996fb5442413_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:660918f5f35b92f89cc172a37d07020874ce4a28e6b03ddc715e999594cfbffd_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:a5bf40d4c25c2fc20e141421265c890d5eca0db43fad9b8d74bef206445d4a4d_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-haproxy-rhel9@sha256:f8aad8047ae755ffd97d68a7cd2894ee1e454f87531f5cce75130b2ed32a695e_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:0329153c21720eeaea09eb6e2a1e7882b70c01109df8d9ff921c31e66420500e_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:6926fe9ec272c61350c8f90282d69c6da8c2e07255172a36a879f7c5b20d8b6b_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:80da04b7f5201a853254479a1063a37fc2c15955011996a81360e7f7cf0c29eb_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/rhceph-promtail-rhel9@sha256:b97bb92014a6a4cbd85c0324273e12c534c3a1809a1da1b3d2b5660b50f45320_ppc64le as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:31df4eb32846b4fb60838ad4f10aee1558e52312b69fb58bf128238406de0681_arm64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:4053cae7e54ff720df9fa3eee654ba8bd91a367d51bb5075f95a1612dbca86a7_s390x as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:53c686b1767d342e5c8a5ff112b0c53db9707394fd7c7ae63b2a11ef1b3bf20d_amd64 as a component of Red Hat Ceph Storage 8
  • registry.redhat.io/rhceph/snmp-notifier-rhel9@sha256:6389bd532d276b37efaad5a37245699d8e055d81c4be4b30907d5a8e1ea6bc80_ppc64le as a component of Red Hat Ceph Storage 8

✅ Remediation

The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command. Workaround: This issue can be mitigated by disabling the capability of the system to generate a coredump for SUID binaries. The perform that, the following command can be ran as `root` user: ~~~ echo 0 > /proc/sys/fs/suid_dumpable ~~~ While this mitigates this vulnerability while it's not possible to update the systemd package, it disables the capability of analyzing crashes for such binaries. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability. Workaround: The impact of this flaw may be reduced by setting strict resource limits to the stack size of processes at the operational system level. This can be achieved either through the 'ulimit' shell built-in or the 'limits.conf' file. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Untrusted TAR archives should always be extracted in an empty directory. When multiple untrusted archives need to be extracted, the same directory must not be re-used without removing all content extracted form the previous archive before extracting the next archive. Workaround: To mitigate the issue, limit XML input size and complexity before parsing, and avoid accepting compressed or deeply nested XML. Use OS-level resource controls (like ulimit or setrlimit()) to cap memory usage, or run the parser in a sandboxed or isolated process with strict memory and CPU limits. This helps prevent denial-of-service by containing excessive resource consumption. Workaround: To mitigate this issue, users should avoid processing untrusted or unverified input with GnuPG. Exercise caution when handling GnuPG-encrypted or signed data from unknown or suspicious sources, as specially crafted input could trigger the vulnerability. This operational control reduces the attack surface by limiting exposure to malicious data.

🔗 References (21)