RHSA-2026:27998HighCVSS 7.5

Red Hat Security Advisory: Cost Management Metrics Operator Update

Published
June 22, 2026
Last Modified
August 24, 2026

🔗 CVE IDs covered (7)

CVE-2026-28390 →CVE-2026-31790 →CVE-2026-2100 →CVE-2026-4046 →CVE-2026-4437 →CVE-2026-4438 →CVE-2026-4878 →

📋 Description

CVE-2026-2100 — p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters CVE-2026-4046 — glibc: glibc: Denial of Service via iconv() function with specific character sets CVE-2026-4437 — glibc: glibc: Incorrect DNS response parsing via crafted DNS server response CVE-2026-4438 — glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions CVE-2026-4878 — libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() CVE-2026-28390 — openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing CVE-2026-31790 — openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key

🎯 Affected products6

  • Cost Management Metrics Operator 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:c2c4a771905d23d7c0aad05672e5d8491c744ccb7f7192ef31e2b93f82a1f3b4_amd64 as a component of Cost Management Metrics Operator 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:40f9729022eb27cefd14f7d0e0d869b936e5862cb079009de45cf7b3626a4275_s390x as a component of Cost Management Metrics Operator 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:62c2477e0d9ceb1998eb0d1b496ee6e46b83433ff901909aa749d6dacfaf23cc_arm64 as a component of Cost Management Metrics Operator 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:92da8c11452f7ae0f24e70d453f03d31e7a10ac1276c5bdc63539952d2c87b23_amd64 as a component of Cost Management Metrics Operator 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e694c9b65667f1989df1a4c7028defd9b42f099046d55807bfef3d766ba65335_ppc64le as a component of Cost Management Metrics Operator 4

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications that process Cryptographic Message Syntax (CMS) EnvelopedData messages should be configured to only accept input from trusted sources. Restricting network access to services that process untrusted CMS data can also reduce exposure to this Denial of Service vulnerability.

🔗 References (12)