RHSA-2026:3228HighCVSS 9.8

Red Hat Security Advisory: Cost Management Metrics Operator Update

Published
February 24, 2026
Last Modified
August 17, 2026

🔗 CVE IDs covered (15)

CVE-2025-15468 →CVE-2025-66199 →CVE-2025-69421 →CVE-2026-22796 →CVE-2025-11187 →CVE-2025-15281 →CVE-2025-69418 →CVE-2025-69419 →CVE-2026-22795 →CVE-2025-15469 →CVE-2025-68160 →CVE-2025-69420 →CVE-2026-0915 →CVE-2025-15467 →CVE-2026-0861 →

📋 Description

CVE-2025-11187 — openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file CVE-2025-15281 — glibc: wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory CVE-2025-15467 — openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing CVE-2025-15468 — openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling CVE-2025-15469 — openssl: OpenSSL: Data integrity bypass in openssl dgst command due to silent truncation CVE-2025-66199 — openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression CVE-2025-68160 — openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter CVE-2025-69418 — openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls CVE-2025-69419 — openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing CVE-2025-69420 — openssl: OpenSSL: Denial of Service via malformed TimeStamp Response CVE-2025-69421 — openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing CVE-2026-0861 — glibc: Integer overflow in memalign leads to heap corruption CVE-2026-0915 — glibc: glibc: Information disclosure via zero-valued network query CVE-2026-22795 — openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing CVE-2026-22796 — openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification

🎯 Affected products6

  • Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:5acccd71d43acf0b452b05a87ddaecffe7bfb4dd47bab24725b1d4ec88879441_amd64 as a component of Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:1dd05671a8614a4354d9ebf94673f9e1bfd7a38af7052c2a4b9a25264f3ee4e1_arm64 as a component of Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:210abe5689a75606b17b1cea30eeef8fd7f0ab39a5d2af6af32e314ed80928c7_amd64 as a component of Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:5ae433507d81fd888260a30b4519daf148c42a71d469e9f63eed75f599733937_s390x as a component of Cost Management 4
  • registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:7424ae28625701b1441987b0457100505e273b2cbcb087bf0c046d7b2cc596c7_ppc64le as a component of Cost Management 4

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html Workaround: To mitigate this issue, avoid processing untrusted PKCS#12 files. Applications should only handle PKCS#12 files from trusted sources, as these files are typically used for storing private keys and are expected to be secure. Workaround: To mitigate this issue, consider refactoring the use of the wordexp function to not use the WRDE_REUSE and WRDE_APPEND flags together. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: To mitigate this issue, avoid using the `openssl dgst` command with one-shot algorithms (such as Ed25519, Ed448, or ML-DSA) for files larger than 16MB. Instead, utilize streaming digest algorithms with `openssl dgst` or use library APIs for signing and verification, as these are not affected by the truncation vulnerability. Users should ensure that input files for one-shot signing/verification with `openssl dgst` do not exceed 16MB. Workaround: To mitigate this issue, disable the reception of compressed certificates by setting the SSL_OP_NO_RX_CERTIFICATE_COMPRESSION option in OpenSSL configurations. This will prevent the vulnerable code path from being exercised. Workaround: To mitigate this vulnerability, Red Hat recommends avoiding the processing of PKCS#12 files from untrusted or unverified sources. Applications that use the `PKCS12_get_friendlyname()` API should ensure that PKCS#12 files are only processed if they originate from trusted entities. Restricting the input sources for PKCS#12 files can significantly reduce the attack surface for this flaw. Workaround: Restrict applications from processing untrusted or externally supplied PKCS#12 files, ensuring certificates are sourced only from trusted internal authorities. Additionally, configure critical background services with automatic restart policies (such as systemd's Restart=on-failure) to quickly restore availability if a denial-of-service crash occurs. Workaround: Applications calling one of the vulnerable functions and allowing the alignment parameter to be set by user-controlled input can implement additional validations checks, ensuring the alignment value is a power of two and does not exceed a sane limit, for example the system page size or a maximum of 64KB. This prevents the excessively large value required to trigger the integer overflow.

🔗 References (20)