RHSA-2026:53371HighCVSS 8.8

Red Hat Security Advisory: Insights proxy Container Image

Published
August 11, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (35)

CVE-2026-9698 →CVE-2026-34356 →CVE-2026-44185 →CVE-2026-5928 →CVE-2026-42536 →CVE-2026-44186 →CVE-2026-47167 →CVE-2026-48864 →CVE-2026-54370 →CVE-2026-58016 →CVE-2026-59858 →CVE-2026-5435 →CVE-2026-10879 →CVE-2026-54369 →CVE-2026-34355 →CVE-2026-44631 →CVE-2024-42516 →CVE-2026-6238 →CVE-2026-14739 →CVE-2026-33006 →CVE-2026-42535 →CVE-2026-57455 →CVE-2026-13757 →CVE-2026-14380 →CVE-2026-24072 →CVE-2026-41989 →CVE-2026-43951 →CVE-2026-55693 →CVE-2026-57456 →CVE-2026-52858 →CVE-2025-6170 →CVE-2026-29169 →CVE-2026-44119 →CVE-2026-59856 →CVE-2026-47162 →

📋 Description

CVE-2024-42516 — httpd: incomplete fix for CVE-2023-38709 CVE-2025-6170 — libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling CVE-2026-5435 — glibc: glibc: Out-of-bounds write via TSIG record processing CVE-2026-5928 — glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings CVE-2026-6238 — glibc: glibc: Application crash or uninitialized memory read via crafted DNS response CVE-2026-9698 — DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution CVE-2026-10879 — perl-DBI: perl-DBI: Heap overflow in SQL preparsing can lead to denial of service or arbitrary code execution. CVE-2026-13757 — p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-14380 — DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14739 — DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders CVE-2026-24072 — Apache HTTP Server: mod_rewrite: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation CVE-2026-29169 — httpd: NULL pointer dereference via specially crafted request CVE-2026-33006 — httpd: mod_auth_digest: timing attack allows a bypass of digest authentication CVE-2026-34355 — httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass CVE-2026-34356 — httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers CVE-2026-41989 — Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext CVE-2026-42535 — httpd: Apache httpd mod_dav_fs: Denial of Service due to path handling issue CVE-2026-42536 — httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc CVE-2026-43951 — httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime CVE-2026-44119 — httpd: Apache HTTP Server: Local .htaccess authors can read files with httpd user privileges CVE-2026-44185 — httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server CVE-2026-44186 — httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server CVE-2026-44631 — httpd: Apache HTTP Server: Denial of Service via crafted regular expressions CVE-2026-47162 — vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47167 — vim: Vim: Arbitrary code execution via crafted step-definition patterns CVE-2026-48864 — libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data CVE-2026-52858 — vim: Vim: Arbitrary code execution via Python omni-completion CVE-2026-54369 — acl: Symlink traversal privilege escalation via libacl functions CVE-2026-54370 — acl: TOCTOU Symlink Traversal via getfacl/setfacl CVE-2026-55693 — vim: Vim: Out-of-bounds Write in Spell File Word Count CVE-2026-57455 — vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() CVE-2026-57456 — vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion CVE-2026-58016 — glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" CVE-2026-59856 — vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion CVE-2026-59858 — vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion

🎯 Affected products3

  • Red Hat Insights proxy 1.5
  • registry.redhat.io/insights-proxy/insights-proxy-container-rhel9@sha256:296963717d1d077fc4a37a323ab0a34843b0b5d3eeaa15af0a5ca07b83dcd2c1_arm64 as a component of Red Hat Insights proxy 1.5
  • registry.redhat.io/insights-proxy/insights-proxy-container-rhel9@sha256:314da33085b943c6365ba0bb1b3fe311e3c9002d2dd0d1a206965bf21c412308_amd64 as a component of Red Hat Insights proxy 1.5

✅ Remediation

The Insights proxy container image provided here is downloaded by the Red Hat Insights proxy product RPM. Before applying this update, make sure all previously released errata relevant to your system have been applied. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly recommended to apply the upstream patch once available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Users are advised to identify network-accessible applications which use perl-DBI and ensure that only trusted users have access to those applications. Workaround: This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication. If p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention. Red Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw. Workaround: To reduce the risk of arbitrary code execution, avoid setting the `DBI_PROFILE` environment variable from untrusted sources. Ensure that DSN driver-attribute clauses, particularly those used with `dbi:Driver(Profile=>SPEC):db`, are not populated with unvalidated or untrusted input. Workaround: Applications utilizing `perl-DBI` should implement robust input validation and limit the number of parameters used in SQL query placeholders, particularly when processing untrusted data. This operational control can prevent the construction of SQL statements with an excessive number of placeholders, thereby reducing the risk of triggering the heap overflow vulnerability. Workaround: To prevent local users from exploiting this flaw via .htaccess file manipulation, configure Apache HTTP Server to disable .htaccess overrides. Set `AllowOverride None` within the main server configuration or relevant `<Directory>` blocks. This restricts the ability of local users to alter server settings. After applying this change, the `httpd` service must be reloaded or restarted for the new configuration to take effect. Example configuration: ``` <Directory "/var/www/html"> AllowOverride None </Directory> ``` To apply changes, reload the service: `sudo systemctl reload httpd` Or restart the service: `sudo systemctl restart httpd` Workaround: Disabling mod_dav_lock and restarting httpd will mitigate this flaw. Workaround: Disable the `mod_proxy_html` module if it is not essential for your Apache HTTP Server configuration. If `mod_proxy_html` is required, restrict its use to trusted backend servers only, employing network segmentation and access controls. After modifying the configuration, reload the httpd service for changes to apply, which may cause a brief service interruption. Steps to disable: Open /etc/httpd/conf.modules.d/00-proxy.conf. Add a # to comment out the line: LoadModule proxy_html_module modules/mod_proxy_html.so Verify configuration syntax: apachectl configtest Apply the change gracefully: systemctl reload httpd Workaround: To prevent this denial-of-service flaw, ensure your Apache proxy rules only connect to highly trusted backend servers. If you must proxy traffic to unverified or external backends, disable the cookie-rewriting features. Steps to Mitigate: Open your Apache configuration file (e.g., /etc/httpd/conf/httpd.conf). Locate and comment out any ProxyPassReverseCookieDomain or ProxyPassReverseCookiePath lines pointing to untrusted backends by adding a # at the start of the line. Test your syntax: apachectl configtest Apply changes gracefully: systemctl reload httpd Note: This may cause a brief service interruption. Workaround: To mitigate this vulnerability, disable the `mod_xml2enc` module if its functionality for XML internationalization is not essential. This can be done by commenting out the `LoadModule xml2enc_module modules/mod_xml2enc.so` directive in the Apache HTTP Server configuration. A service restart is required for the change to take effect. ```bash # Edit the Apache configuration file, e.g., /etc/httpd/conf.modules.d/00-base.conf # Comment out the line: # LoadModule xml2enc_module modules/mod_xml2enc.so # Reload the httpd service sudo systemctl reload httpd ``` *Note: Disabling `mod_xml2enc` will cause any configurations relying heavily on `mod_proxy_html` or raw HTML/XML encoding conversions to function incorrectly or fail. Red Hat strongly recommends upgrading to a patched version of `httpd` as soon as it becomes available for your specific RHEL channel.* Workaround: - Those who do not require multi-language response headers can remove or disable the `mod_headers` and `mod_mime` modules, or remove Content-Language directives from their configuration. - Systems not using these modules in combination are not affected. Workaround: To mitigate this issue, ensure that Apache HTTP Server is configured to only communicate with trusted OCSP responders. If OCSP validation or stapling is not a critical requirement for your deployment, consider disabling it. This can be achieved by adjusting mod_ssl directives in your Apache HTTP Server configuration. For example, add or modify the following lines: ~~~ SSLOCSPEnable off SSLUseStapling off ~~~ After modifying the configuration, reload the httpd service for the changes to take effect safely without interrupting active connections: ~~~ sudo systemctl reload httpd ~~~ Workaround: To mitigate this issue, you can disable the `mod_proxy_ftp` module if your environment does not require it. #### **Step 1: Disable the Module** Open your Apache HTTP Server configuration file (commonly located at `/etc/httpd/conf.modules.d/00-proxy.conf` or `/etc/httpd/conf/httpd.conf`) and comment out or remove the following line: ``` # LoadModule proxy_ftp_module modules/mod_proxy_ftp.so ``` #### **Step 2: Restart the Service** Restart the `httpd` service to apply the configuration changes: ``` systemctl restart httpd ``` **Note:** Disabling this module may impact applications or services that rely on Apache's FTP proxy functionality. Workaround: Only loadtrustedApache configuration; the bug triggers oncrafted regexin config at start/reload (DirectoryMatch,Directory ~,ProxyMatch, etc.). Keep AllowOverride None where possible so untrusted users cannot inject regex via .htaccess. Restrict who can change httpdconfig and reload the service. Workaround: To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns. Workaround: Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration …

🔗 References (38)